What it means
Detection may rely on signatures, behavior, protocol analysis, reputation, or anomaly patterns. Prevention adds operational risk because an incorrect decision can interrupt legitimate activity.
Why it matters
These controls provide visibility at network and host boundaries when they are tuned to the environment and connected to a response process.
Practical focus
- Place sensors where they can observe meaningful traffic
- Tune rules using local assets and expected behavior
- Validate blocking rules before broad enforcement
- Connect alerts to investigation context and ownership
Common mistakes
- Enabling every rule without tuning
- Counting alerts rather than measuring useful detections
- Assuming encrypted traffic is fully visible
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: