--- title: "Intrusion Detection System" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/features/intrusion-detection-system/" --- Solution # Intrusion Detection System Detect and mitigate Advanced Persistent Threats (APTs) using machine learning and a rule-based engine that enables active monitoring [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ![Threatfeeds+DPI](https://embed-ssl.wistia.com/deliveries/26f7ee423c281d5bc8cdca3e22d2733c77d0f93b.jpg?image_crop_resized=612x344) ## Benefits ![Two overlapping blue parallelograms](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/05/Icon-1.png) ### Workload Protection Protects sensitive Kubernetes workloads against vulnerabilities and threat actors deploying APTs, zero-day attacks, and other exploits, using automated detection, response, and mitigation ### Custom Alerts Ensures security teams are immediately notified when an attack or intrusion occurs, enabling further investigation and prompt remediation ### Runtime Defense Provides critical, supplemental protection to firewall defenses to ensure that sensitive workloads are not exposed if there is a perimeter breach ## Trusted by Customers Worldwide [![Orange logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Siemens Healthineers logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Nowcom logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-NOWCOM.png)](http://www.nowcom.com/) [![Presidio logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![Essentra logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![GoDaddy logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/10/logo-eHealth.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/ehealth-case-study/) [![Coinmetrics logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ## Capabilities ![Threat](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/threat-feed-integration.png) ### Threat Feed Integration - Calico ingests threat feeds that identify IP addresses and matches SNORT signatures for known bad actors such as botnets. Any ingress or egress traffic to those IPs or SNORT signatures are automatically blocked and can be configured to generate alerts. Traffic to VPNs and ToR exit nodes is blocked and triggers alerts when detected. - Firewalls often detect and block traffic associated with known bad actors, but don’t have visibility into which pod is infected. The Calico threat feed pinpoints and reports on the exact source of malicious traffic. ![Alerts Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/suspicious-alert.png) ### Custom Alerts - Calico alerts on unauthorized changes to your cluster and security policies as well as known attack patterns such as domain generation algorithms (DGA). - Alerts are available out-of-the-box and can be customized and augmented by your security researchers or Tigera’s team of experts. ![Service Graph Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/service-graph-07.png) ### Anomaly Detection - Calico’s Anomaly Detection capability evaluates traffic flows using machine learning to identify the baseline behavior of your microservice environment, and generates alerts when unexpected behavior is detected. This enables you to detect and protect your Kubernetes environment against zero-day exploits. - Port scans, IP sweeps, and service byte anomalies can all be indicators that your environment has been compromised and is hosting an advanced persistent threat (APT). Calico detects and alerts on that activity and can [quarantine](/features/intrusion-detection-system/#automatic-remediation) those workloads. - Calico can detect and prevent OWASP Top 10 attacks that might be targeting your microservices. ![Honeypods](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/honeypods.png) ### Honeypods - Honeypods are fake pods that run in your cluster. Any traffic to these pods will generate an alert in Calico that will trigger further inspection. - When traffic hits a honeypod, Calico inspects packets from the traffic and analyzes it for known malware signatures, using SNORT and other tools. - Inspecting all cluster traffic for malware can create a huge performance penalty. Calico utilizes an innovative approach that doesn’t impact performance to identify suspicious cluster traffic that warrants deeper inspection. ![Configure Security for Critical Workloads](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/configure-security-for-critical-workloads.png) ### Sensitive Workload Protection - Calico provides supplemental detection and alerting for any workloads that may have access to sensitive data. - Calico will detect and alert on abnormal activity, effectively creating a virtual moat to protect your critical workloads. - Defining your moat is as simple as using a label and then defining detailed alerts for workloads with those labels. ![Automatic Remediation](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/automatic-remediation.png) ### Automatic Remediation - Alerts generated by Calico can be configured to trigger automated remediation. - Rogue microservices are immediately isolated from the network, and Calico’s IDS automatically generates policy - Quarantined workloads can be left running for forensic analysis. ## How It Works ![IDS_long](https://embed-ssl.wistia.com/deliveries/410e824f40a0fd0e7f6ab4df6be4893f.jpg?image_crop_resized=612x344) Companies are leveraging the power of Kubernetes to accelerate the delivery of applications to meet the pace of business. However, the dynamic nature of Kubernetes makes it operationally challenging to protect applications against vulnerabilities and threat actors deploying APTs, zero-day attacks, and other exploits. Calico’s IDS protects sensitive data from these threats using a highly-effective combination of automated detection, response, and mitigation. ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Resources ![O’Reilly eBook: Kubernetes Security and Observability](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/Featured-resources-OReilley-ebook.png) eBook ### O’Reilly eBook: Kubernetes Security and Observability Learn to secure Kubernetes workloads and monitor network traffic for compliance and security. [Learn More](https://www.tigera.io/blog/oreilly-ebook-kubernetes-security-and-observability-early-release/) ![How Calico Cloud’s runtime defense mitigates Kubernetes MITM vulnerability CVE-2020-8554](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/04/MITM.png) Blog ### How Calico Cloud’s runtime defense mitigates Kubernetes MITM vulnerability CVE-2020-8554 Learn how to mitigate the Kubernetes MITM vulnerability CVE-2020-8554 using runtime defense. [Learn More](https://www.tigera.io/blog/how-calico-clouds-runtime-defense-mitigates-kubernetes-mitm-vulnerability-cve-2020-8554/) ![Introduction to Kubernetes Networking and Security](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/Calico-Enterprise-Tigera-1200x628-1.png) Documentation ### Introduction to Kubernetes Networking and Security Read our docs and see how you can kickstart your Kubernetes journey with Calico Enterprise. [Read More](https://docs.tigera.io/calico-enterprise/latest/about/) ![Calico Logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/)