a system that creates logs of all network traffic that was permitted to pass the firewall and then analyzes those logs for signs of attempted or successful intrusions
a system that creates logs of all network traffic that was permitted to pass the firewall and then analyzes those logs for signs of attempted or successful intrusions
sit on the network and monitor traffic searching for signs of potential malicious activity like  -intrusion detection -malformed packets attempting to create a denial of service -botnet -unusual logins