Answers.Body: <p>It still has a use and does catch some attacks, but it does sometimes give false positives for civi (e.g. copy/pasting a long email thread into an activity is the one I usually see), and yes is very old. Some firewalls have traffic analysis that can be an alternative, or if you have access you could install an alternative IDS like <a href="https://www.snort.org" rel="nofollow noreferrer">Snort</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-05-16T14:43:31.027Z
Answers.Text: The good thing about Snort is that it has documentation
Answers.UserDisplayName: Kainuk - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-05-16T12:53:00.307Z
Answers.LastActivityDate: 2022-05-16T12:53:00.307Z
Answers.UserDisplayName: Demerit
Body: <p>One of my clients sends emails with click-through links. And sometimes, after clicking on the link, the following message is displayed.<a href="https://i.sstatic.net/l6TsX.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/l6TsX.jpg" alt="enter image description here" /></a></p>
  <p>I did some research. The error is generated from a piece of code that does an IDS check. IDS stands for Intruder Detection System. It can be disabled in Drupal 7 by granting the skip IDS check to the anonymous user.</p>
  <p><a href="https://i.sstatic.net/yySGo.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/yySGo.png" alt="enter image description here" /></a></p>
  <p>Now I have a workaround, but comment of the grants says <em>this permission has security implications</em></p>
  <p>What are exactly this security implications? Clients are always reluctant in disabling security stuff.</p>
  <p>The work for IDS is done by the PHP package PHPIDS. It can be found on GitHub <a href="https://github.com/PHPIDS/PHPIDS" rel="nofollow noreferrer">https://github.com/PHPIDS/PHPIDS</a>. I could not find any documentation about how it works. The stats show me the following.</p>
  <ul>
  <li>The project is a bit old. Last commit in 2014.</li>
  <li>The project was also popular - 224 forks.</li>
  </ul>
  <p>So maybe the IDS solves a problem from a long time ago and is not needed any more. Does someone (with a good memory) know the answers?</p>
  
Tags: <permissions><security>
Title: What does IDS (Intrusion Detection System) exactly? What happens if I disable it?
ThreadText: # What does IDS (Intrusion Detection System) exactly? What happens if I disable it?
  
  (Asked by: username_0 on 2022-05-16)
  
  One of my clients sends emails with click-through links. And sometimes, after clicking on the link, the following message is displayed.[![enter image description here](https://i.sstatic.net/l6TsX.jpg)](https://i.sstatic.net/l6TsX.jpg)
  
  I did some research. The error is generated from a piece of code that does an IDS check. IDS stands for Intruder Detection System. It can be disabled in Drupal 7 by granting the skip IDS check to the anonymous user.
  
  [![enter image description here](https://i.sstatic.net/yySGo.png)](https://i.sstatic.net/yySGo.png)
  
  Now I have a workaround, but comment of the grants says *this permission has security implications*
  
  What are exactly this security implications? Clients are always reluctant in disabling security stuff.
  
  The work for IDS is done by the PHP package PHPIDS. It can be found on GitHub <https://github.com/PHPIDS/PHPIDS>. I could not find any documentation about how it works. The stats show me the following.
  
  * The project is a bit old. Last commit in 2014.
  * The project was also popular - 224 forks.
  
  So maybe the IDS solves a problem from a long time ago and is not needed any more. Does someone (with a good memory) know the answers?
  
  **Tags:** permissions, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-05-16. Score: 1
  
  It still has a use and does catch some attacks, but it does sometimes give false positives for civi (e.g. copy/pasting a long email thread into an activity is the one I usually see), and yes is very old. Some firewalls have traffic analysis that can be an alternative, or if you have access you could install an alternative IDS like [Snort](https://www.snort.org).
  
  > **Comments:**
  > **username_0**: The good thing about Snort is that it has documentation  
  
  ---
  
  