My response assumes your IDS-4215 is running Cisco IDS version 4.1 software.
In your case, I'd suggest that you would want to watch the Internal network side of the PIX. A TAP on the line between your PIX and the next physical device will give you great coverage, assuming you want to run passively and don’t prefer using SPAN.
Doing this will serve two purposes. First, it will confirm that whatever traffic your PIX has allowed to pass is not malicious, and will notify you if it is. Second, it will give you an indication if anything resident on your Internal network is trying to pass any undesirable traffic out through the firewall (i.e. – a walk-in worm)
If you happen to have an IDS-4FE-INT installed on your IDS-4215, you could actually watch both sides of your firewall, but this is normally only done where you're either really paranoid or impelled by something, such as policy, to do so.
I hope this helps,
Alex Arndt
