Intrusion Detection

Learning objectives

• Explain the main cyber decision that Intrusion Detection is designed to support.
• Change input assumptions and predict how the output should respond before running the demo.
• Interpret the result in plain language, not just as a number, chart, or AI recommendation.
• State one limitation, risk, or governance consideration before using the result in a real decision.

Run modes

• Supported modes: Browser
• Demo type: Interactive browser demo
• Primary launch surface: index.html

Before you start

Starts immediately in browser with no installs, no API keys, and classroom-safe defaults.

This helps set classroom expectations before students click into the live experience.

Core context

Look for network events, anomaly indicators, and alert classification.

Observe how normal operational patterns differ from suspicious intrusion signals.

Concepts covered

What students should note

Note that intrusion detection should lead to evidence, containment, and escalation decisions.

List of steps

• Choose the run mode that fits the class: Browser.
• Review the default assumptions before changing anything.
• Change one or two inputs, then use `Run the main action`.
• Read the output first, then compare any supporting metrics, charts, or AI text.
• Capture one insight, one limitation, and one action recommendation.

Input variables explained

• Start with the default assumptions, then change one variable at a time so students can isolate cause and effect.
• Treat each input as a lever that changes the scenario, baseline, or business context behind the result.

Decision buttons explained

• Use the main run or simulate action to compute the scenario after inputs are set.
• Use export or reset actions, when present, to compare runs or return to a classroom-safe baseline.

Outputs explained

• Read the top-line result first, then look for supporting metrics, tables, or narratives that explain why it changed.
• Students should explain whether the output is descriptive, predictive, simulated, or recommended.

What to notice

• Look for network events, anomaly indicators, and alert classification
• Observe how normal operational patterns differ from suspicious intrusion signals
• Note that intrusion detection should lead to evidence, containment, and escalation decisions

Discussion and reflection

• What business or technical decision would you make differently after using Intrusion Detection?
• If you changed one assumption and ran `main action`, which output moved the most and why?
• What would you still want to validate with real data, policy, or expert review before acting on the result?