-monitors network/system activities -alert when potentially malicious activity is found -logs info about activities
detects inappropriate or malicious activity
the data contained in each field of a record in a table.