Software or device that inspects and flags system and network activity for suspicious activity, such as modified files or unauthorized entry.