专用服务访问通道是您的虚拟私有云 (VPC) 网络与 Google 或第三方拥有的网络之间的专用连接。对于 Cloud IDS，专用连接会将您的虚拟机连接到 Google 管理的对等互连虚拟机。对于位于同一 VPC 网络中的 IDS 端点，系统会重复使用相同的专用连接，但会为每个端点分配新的子网。如果您需要向现有专用连接添加 IP 地址范围，则必须修改连接。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[[["\u003cp\u003eCloud IDS is an intrusion detection service that uses Palo Alto Networks threat protection technologies to identify intrusions, malware, spyware, and command-and-control attacks within your network traffic.\u003c/p\u003e\n"],["\u003cp\u003eCloud IDS provides visibility into all network traffic, including north-south and east-west communications, allowing for the detection of lateral movement and intra-subnet threats.\u003c/p\u003e\n"],["\u003cp\u003eCloud IDS uses IDS endpoints to receive and analyze mirrored traffic, with each endpoint having a maximum inspection capacity of 5 Gbps, capable of handling spikes up to 17 Gbps.\u003c/p\u003e\n"],["\u003cp\u003eThreat detection is enhanced through Palo Alto Networks' Application-ID (App-ID), which identifies applications regardless of port or protocol, and a customizable default set of threat signatures that protect against vulnerabilities and spyware.\u003c/p\u003e\n"],["\u003cp\u003eCloud IDS automatically updates its signatures daily, ensuring protection against emerging threats, and allows for the customization of alerts by adjusting the minimum severity level or creating threat exceptions.\u003c/p\u003e\n"]]],[],null,["# Cloud IDS overview\n\nCloud IDS is an intrusion detection service that provides threat\ndetection for intrusions, malware, spyware, and command-and-control attacks\non your network. Cloud IDS works by creating a Google-managed peered\nnetwork with mirrored virtual machine (VM) instances. Traffic in the peered\nnetwork is mirrored and then\ninspected by Palo Alto Networks threat protection technologies to provide\nadvanced threat detection. You can mirror all traffic, or you can mirror\nfiltered traffic based on protocol, IP address range, or ingress and egress.\n\nCloud IDS provides full visibility into network traffic, including both\nnorth-south and east-west traffic, letting you monitor VM-to-VM communication to\ndetect lateral movement. This provides an inspection engine that inspects\nintra-subnet traffic.\n\nYou can also use Cloud IDS to meet your advanced threat detection and\ncompliance requirements, including\n[PCI 11.4](/security/compliance/pci-dss) and [HIPAA](/security/compliance/hipaa).\n\nCloud IDS is subject to Google Cloud's\n[Cloud Data Processing Addendum](/terms/data-processing-addendum).\n\nCloud IDS detects and alerts on threats, but it does not take action to\nprevent attacks or repair damage. To take action on the threats that Cloud IDS\ndetects, you can use products such as [Google Cloud Armor](/armor/docs/cloud-armor-overview).\n\nThe following sections provide details about IDS endpoints and\nadvanced threat detection.\n\nIDS endpoints\n-------------\n\nCloud IDS uses a resource known as an *IDS endpoint*, a zonal resource\nthat can inspect traffic from any zone in its region. Each IDS endpoint\nreceives mirrored traffic and performs threat detection analysis.\n\n[Private services access](/vpc/docs/configure-private-services-access) is a private\nconnection between your Virtual Private Cloud (VPC) network and a network owned by\nGoogle or a third party. In the case of Cloud IDS, the private connection\nconnects your VMs to the Google-managed peered VMs.\nFor IDS endpoints in the same VPC network, the same private\nconnection is re-used, but a new subnet is assigned for each endpoint.\nIf you need to add IP address ranges to an existing private connection,\nyou must\n[modify the connection](/vpc/docs/configure-private-services-access#modifying-connection).\n\nYou can use Cloud IDS to create an IDS endpoint in each region that\nyou want to monitor. You can create multiple IDS endpoints for each region.\nEach IDS endpoint has a maximum inspection capacity of 5 Gbps. While each\nIDS endpoint can handle anomalous traffic spikes of up to 17 Gbps, we\nrecommend that you configure one IDS endpoint for every 5 Gbps of throughput\nthat your network experiences.\n\n### Packet mirroring policies\n\nCloud IDS uses Google Cloud Packet Mirroring, which creates\na copy of your network traffic. After creating an IDS endpoint, you must attach\none or more *packet mirroring policies* to it. These policies send mirrored traffic\nto a single IDS endpoint for inspection. The packet mirroring logic sends all\ntraffic from individual VMs to Google-managed IDS VMs: for example,\nall traffic mirrored from `VM1` and `VM2` is always sent to `IDS-VM1`.\n\nAdvanced threat detection\n-------------------------\n\nCloud IDS threat detection capabilities are powered by the following Palo\nAlto Networks threat prevention technologies.\n\n### Application-ID\n\nPalo Alto Networks' Application ID (App-ID) provides visibility into the\napplications running on your network. App-ID uses multiple identification\ntechniques to determine the identity of applications traversing your network,\nirrespective of port, protocol, evasive tactic, or encryption. App-ID identifies\nthe application, providing you with knowledge to help secure your application.\n\nThe list of App-IDs is expanded weekly, with three to five new applications typically\nadded based on input from customers, partners, and market trends. After a new\nApp-ID is developed and tested, it is automatically added to the list as part of\nthe daily content updates.\n\nYou can view application information on the **IDS Threats** page in the\nGoogle Cloud console.\n\n[Go to IDS Threats](https://console.cloud.google.com/net-security/ids/threats)\n\n### Default signature set\n\nCloud IDS provides a default set of\n[threat signatures](https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/threat-signatures.html)\nthat you can use immediately to protect your network from threats. In the\nGoogle Cloud console, this signature set is called a *Cloud IDS service profile.*\nYou can customize this set by choosing the minimum alert severity level. The\nsignatures are used to detect vulnerabilities and spyware.\n\n- **Vulnerability detection signatures** detect attempts to exploit system flaws\n or gain unauthorized access to systems. While anti-spyware signatures help\n identify infected hosts when traffic leaves the network, vulnerability\n detection signatures protect against threats that enter the network.\n\n For example,\n vulnerability detection signatures help protect against buffer overflows,\n illegal code execution, and other attempts to exploit system vulnerabilities.\n The default vulnerability detection signatures provide detection for clients\n and servers from all known critical, high, and medium-severity threats.\n- **Anti-spyware signatures** are used to detect spyware on compromised hosts. Such\n spyware might try to contact external command-and-control (C2) servers. When\n Cloud IDS detects malicious traffic leaving your network from infected\n hosts, it generates an alert that is saved in the threat log and shown\n in the Google Cloud console.\n\n### Threat severity levels\n\nA signature's severity indicates the risk of the detected event, and\nCloud IDS generates alerts for matching traffic. You can choose the\nminimum severity level in the default signature set. The following table\nsummarizes the threat severity levels.\n\n### Threat exceptions\n\nIf you decide that Cloud IDS generates alerts on more threats than is necessary,\nyou can disable noisy or otherwise unnecessary threat IDs by using the\n`--threat-exceptions` flag. You can find the threat IDs of existing\nthreats detected by Cloud IDS in your threat logs. You are limited to 99\nexceptions per IDS endpoint.\n\nContent update frequency\n------------------------\n\nCloud IDS automatically updates all signatures without any user\nintervention, enabling users to focus on analyzing and resolving threats\nwithout managing or updating signatures. Content updates include Application-ID\nand threat signatures, including vulnerability and anti-spyware signatures.\n\nUpdates from Palo Alto Networks are picked up daily by Cloud IDS and\npushed to all existing IDS endpoints. Maximum update latency is estimated to be\nup to 48 hours.\n\nLogging\n-------\n\nSeveral features of Cloud IDS generate alerts, which are sent to the threat\nlog. For more information about logging, see\n[Cloud IDS Logging](/intrusion-detection-system/docs/logging).\n\nLimitations\n-----------\n\n- When you use Cloud Next Generation Firewall L7 inspection policies and Cloud IDS endpoint policies, ensure that the policies don't apply to the same traffic. If the policies overlap, the L7 inspection policy takes priority, and the traffic is not mirrored.\n\nWhat's next\n-----------\n\n- To set up Cloud IDS, see [Configure Cloud IDS](/intrusion-detection-system/docs/configuring-ids)."]]
