I'm going to answer both your questions in a kinda non-specific way, but bear with me.

Your first question is "I'm putting in an IDS, what should I tell it to do?"

Well, you're doing it backwards, but don't worry - this is a common security confusion.

An IDS, like any security system, is not a magic wand. You don't just install it and everything's hunky dory. It's a tool, that you use to treat a specific risk.

So you have to start with a risk analysis. Identify all the threats you face, and the vulnerabilities in your setup that those threats might use to harm your assets. Those are the risks. Identify the likelihood of those risks happening, and the harm they could cause. Those are the risk levels. Now you can tell which risks you are happy with, and which you need to treat.

For example, if you decide that "a NOC employee inadvertently brings a compromised computer onto the network" is a risk that is currently at an unacceptable level, then you sit and figure out a way to fix it. Part of that fix might be to have an IDS sitting inside the NOC looking at all the traffic going by. Not all of it though - you'll probably also be looking at improved scanning of machines before they get in, better processes for employees, etc. etc. You pick the control based on how well it reduces the risk.

Then you do the same process again for "exploits against the web server" and all the other risks your analysis found.

The key is: Identify and understand the risk first, and then put treatments in place to reduce it.

Your second question is "I have a strong perimeter, do I need an IDS behind it?"

There's an important security principle called "defence in depth". Basically, don't rely on one control to protect you. Layer controls, and think about what happens if one fails.

Sure, you have a strong perimeter, and little is going to get through, and thats good. But if something does, wouldn't it be nice to have an IDS there that sees it?

Of course, the question is if it is worth the expense. Snort's free, sure, but your time isn;t. That's something for you to work out, based on the risk level - how likely is something to get through, how much harm could it do? Maybe it's worth it, maybe not. That's a pure business decision.

I'm going to answer both your questions in a kinda non-specific way, but bear with me.

Your first question is "I'm putting in an IDS, what should I tell it to do?"

Well, you're doing it backwards, but don't worry - this is a common security confusion.

An IDS, like any security system, is not a magic wand. You don't just install it and everything's hunky dory. It's a tool, that you use to treat a specific risk.

So you have to start with a risk analysis. Identify all the threats you face, and the vulnerabilities in your setup that those threats might use to harm your assets. Those are the risks. Identify the likelihood of those risks happening, and the harm they could cause. Those are the risk levels. Now you can tell which risks you are happy with, and which you need to treat.

For example, if you decide that "a NOC employee inadvertently brings a compromised computer onto the network" is a risk that is currently at an unacceptable level, then you sit and figure out a way to fix it. Part of that fix might be to have an IDS sitting inside the NOC looking at all the traffic going by. Not all of it though - you'll probably also be looking at improved scanning of machines before they get in, better processes for employees, etc. etc. You pick the control based on how well it reduces the risk.

Then you do the same process again for "exploits against the web server" and all the other risks your analysis found.

The key is: Identify and understand the risk first, and then put treatments in place to reduce it.

Your second question is "I have a strong perimeter, do I need an IDS behind it?"

There's an important security principle called "defence in depth". Basically, don't rely on one control to protect you. Layer controls, and think about what happens if one fails.

Sure, you have a strong perimeter, and little is going to get through, and thats good. But if something does, wouldn't it be nice to have an IDS there that sees it?

Of course, the question is if it is worth the expense. Snort's free, sure, but your time isn't. That's something for you to work out, based on the risk level - how likely is something to get through, how much harm could it do? Maybe it's worth it, maybe not. That's a pure business decision.