[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eCloud IDS is a threat detection service that uses IDS endpoints to monitor network traffic for intrusions, malware, spyware, and command-and-control attacks.\u003c/p\u003e\n"],["\u003cp\u003eCreate an IDS endpoint in each region you wish to monitor, noting that multiple endpoints can be created per region, each with a maximum inspection capacity of 5 Gbps.\u003c/p\u003e\n"],["\u003cp\u003eWhen creating an IDS endpoint, the \u003ccode\u003einformational\u003c/code\u003e alert severity level is recommended for maximum visibility.\u003c/p\u003e\n"],["\u003cp\u003eIf you create packet mirroring policies via the Packet mirroring page, ensure "Allow both ingress and egress traffic" is enabled; however, this is automatically enabled when using the Cloud IDS page.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to attach multiple packet mirroring policies to an IDS endpoint if mirroring traffic from diverse sources, but only from subnets in the same region as the endpoint.\u003c/p\u003e\n"]]],[],null,["# Best practices for Cloud IDS\n\nThis page provides best practices for configuring Cloud IDS.\n\nCloud IDS is an intrusion detection service that provides threat\ndetection for intrusions, malware, spyware, and command-and-control attacks\non your network. Cloud IDS uses a resource known as an *IDS endpoint*, a\nzonal resource that can inspect traffic from any zone in its region. Each IDS\nendpoint receives mirrored traffic and performs threat detection analysis.\n\nDeploy IDS endpoints\n--------------------\n\n- Create an IDS endpoint in each region that you want to monitor by using Cloud IDS. You can create multiple IDS endpoints for each region.\n- Allow up to 20 minutes for Cloud IDS to create and configure firewalls.\n- During IDS endpoint creation, you must choose an alert severity level. For maximum visibility, we recommend the `informational` level.\n- If you use the **Packet mirroring** page in the Google Cloud console to create a packet mirroring policy, ensure that you enable **Allow both ingress and egress traffic** .\n\n [Go to Packet mirroring](https://console.cloud.google.com/networking/packetmirroring)\n- If you use the **Cloud IDS** page to configure an IDS endpoint, you do not need to enable **Allow both ingress and egress traffic** because it is automatically enabled.\n\n [Go to the Cloud IDS dashboard](https://console.cloud.google.com/net-security/ids/dashboard)\n\nYou can use Cloud IDS to create an IDS endpoint in each region that\nyou want to monitor. You can create multiple IDS endpoints for each region.\nEach IDS endpoint has a maximum inspection capacity of 5 Gbps. While each\nIDS endpoint can handle anomalous traffic spikes of up to 17 Gbps, we\nrecommend that you configure one IDS endpoint for every 5 Gbps of throughput\nthat your network experiences.\n\nAttach packet mirroring policies\n--------------------------------\n\n- We recommend that you attach more than one packet mirroring policy to an IDS endpoint when you want to mirror traffic from multiple types of sources, including subnets, instances, or network tags. You can only mirror traffic from subnets that exist in the same region as the IDS endpoint.\n- Choose only the subnets whose traffic you want to mirror to Cloud IDS.\n\nWhat's next\n-----------\n\n- To review conceptual information, see the [Cloud IDS overview](/intrusion-detection-system/docs/overview).\n- To set up Cloud IDS, see [Configure Cloud IDS](/intrusion-detection-system/docs/configuring-ids)."]]
