A device or software application that monitors network or system activities for malicious actions or policy violations and produces alerts for security administrators.