Intrusion Detection Systems
An IDS detects suspicious activity via signatures (known) and anomalies (behavior). An IPS adds automatic prevention. NIDS monitors the network, HIDS monitors hosts. Solutions include Snort, Suricata, and capabilities built into NGFWs.