The growing use of deep learning in intrusion detection systems (IDS) has increased the need for explainable IDS (X-IDS). Current X-IDS research mainly relies on local surrogate models and their explanations are limited due to the complex features of network traffic. In contrast, counterfactual explanations improve interpretability by contrasting “why P rather than Q”, avoiding complex absolute explanations. In this paper, we outline the theoretical value of counterfactual explanations in X-IDS, and propose a two-stage search method for generating counterfactuals. Moreover, we also propose a submodular pick method for counterfactual explanations that provides diverse explanation instances, aiming to interpret the entire model rather than individual samples. Experimental results demonstrate that our proposed method achieves an 80% improvement in fidelity and is 100 times more computationally efficient compared with LIME within the X-IDS domain.