They want a way to centrally monitor, manage and gather log information from firewalls, IDS and other tools. Vendors of various security solutions, such as IDS or access control devices, are also trying to help their customers deal with this difficulty. Central security administration products are designed to solve the problem of the distributed security infrastructure. These systems can be automated to react to possible attacks by taking actions to protect a network based on set policies. What they cannot yet do is take over the job of the administrator completely.
Administrators know their networks.
When something happens, the alert must be evaluated in the context of the protected network. When companies first deploy such systems, he adds that they often follow a learning curve. They must use network knowledge and vulnerability information when making this decision. Policy - They must learn to create an incident response policy that codifies what they just did. Planning - IDS must be made a part of an ongoing network maintenance, operation and growth.