As Intrusion Detection Systems become more sophisticated, the software manufacturers develop different methods of detection. If an IDS uses the process of matching known attacks against data collected in your network, what is this known as?

You are configuring your new Intrusion Detection System, and studying the true-false matrix. You read about the different types of alarms and events. Which of the following defines an event where an alarm is indicating an intrusion when there is no actual intrusion?

What step in the process of Intrusion Detection as shown in the exhibit would an e-mail be delivered to the security admin if an attack were presently taking place?