Intrusion detection is instrumentation of a computer network for data collection.
Pattern-based software ‘sensors’ monitor the network traffic and raise ‘alarms’ when the traffic fundamental issues: How would the sensors perform? How much data
would we get? How would we display the data? What kind of data did we want to see, and what
queries would be best to highlight that data? Next, as the data came in, sensor tuning, incident
investigation, and system performance commanded our attention. The analyst team grew to
handle the load, and training and team coordination were the issues of the day.