A device or software application that monitors a network or systems for malicious activity or policy violations.