GreybeardGreybeard forty seven.1k55 gold badges4444 silver badges149149 bronze badges Increase a remark   A HIDS generally works by having periodic snapshots of critical working system information and evaluating these snapshots after a while. If your HIDS notices a adjust, like log do