Hack the Route Start free Open app Detection and response
Host intrusion prevention (HIDS/HIPS)
Host-based monitoring that detects or blocks suspicious local activity, such as changes to critical files.
A host IDS/IPS runs on the machine itself, watching logs, system calls and critical files. It notices a new file in a startup directory, an unexpected listening port, or a modified binary — and an IPS variant can block the action outright. Where a network sensor sees traffic, a host sensor sees what the traffic did on the box, which is where persistence and dropped implants show up.