Host-Based Intrusion Detection System
A HIDS runs as software on an individual computer and monitors that machine's logs, file changes, and processes for signs of compromise. Unlike a network sensor, it can see encrypted activity after it is decrypted on the host. It is a key layer for catching attacks that never cross a monitored network link.