GCIA: GIAC Certified Intrusion AnalystDemo

A host-based intrusion detection system examines activity locally on the endpoint it is installed on -- log files, file integrity, process and system-call behavior -- rather than capturing packets in transit across the network, so it is inherently unable to correlate or detect intrusion events that are scattered across multiple hosts on the network; because it evaluates data only after it has already been decrypted and processed by the host's own applications and operating system, however, it is not hindered by network-level encryption and can inspect encrypted and unencrypted traffic with equal effectiveness, unlike network-based sensors that must inspect payloads in flight.