Detects, but does not necessarily block, malicious traffic into a network
Similar to IPS, but does not actively block, only alerts when a signal is detected