device or software application that monitors a system or network and analyzes the data passing through it in order to identify an incident or attack
deep inspection of application messages across multiple packets to identify malicious activity
knowledge and past experiences of human specialists are represented as cases and stored in a database for later retrieval; medical and customer support systems