Security software installed on individual devices to monitor for suspicious activity and policy violations.
A Host-based Intrusion Detection System (HIDS) monitors activity on individual servers or workstations rather than network traffic. HIDS examines system logs, file integrity, registry changes, running processes, and user activity to detect attacks that have bypassed network defences. It's particularly effective at detecting insider threats, malware that's already on a system, and attacks using encrypted channels that network-based detection can't inspect. Modern EDR solutions incorporate and extend HIDS capabilities with behavioural analysis and response automation.
Why It Matters
The DSC Perspective:
Network monitoring can't see everything—especially encrypted traffic. HIDS provides visibility into what's happening on your critical servers. EDR has largely superseded standalone HIDS for endpoints, but the concept remains important for server security.