Software on one computer watches that computer’s logs, file changes, and process starts, and raises an alert when the record looks suspicious. It is the host placement of an Intrusion Detection System (IDS). A Network-based Intrusion Detection System (NIDS) is the placement that watches traffic between computers rather than activity inside one machine.
What the Sensor Watches
The program reads evidence the computer already produces. It does not need a vantage point in the middle of the network to do that work.
- Logs. Sign-in attempts, service messages, and application errors written on that computer.
- File changes. Files added, edited, or removed, including system files someone might replace.
- Process starts. Programs that begin running, whether a person, a schedule, or another process launched them.
A match to a known bad pattern, or a sharp break from the computer’s usual behavior, produces an alert. The alert is a notice. The sensor does not, by itself, block a packet on the network.
Visibility After Decryption
Encrypted traffic becomes readable on the host only after the computer decrypts it for an application. The sensor can then see the files, commands, and log lines that followed. It sees what happened on the host after traffic was decrypted.
That view stops at the computer where the software is installed. It does not see other computers’ traffic. Packets that never reached this machine, and activity that never touched its files or its process list, stay outside its record.
Host Sensor and Network Sensor
| Comparison | Host sensor | Network sensor |
| Where it runs | On one computer | On a path that can observe traffic between computers |
| What it watches | That computer’s logs, file changes, and process starts | Packets and connections that cross the monitored path |
| After decryption | Sees what the computer did once traffic was decrypted | Sees the traffic on the path, which may still be encrypted |
| Other computers | Does not see their traffic | Can see exchanges that never produced a log on this computer |
| Blocking | Raises an alert and does not, by itself, block a packet on the network | Reports what it observes. Dropping a packet is a separate control |