If risk assessment tells you where you have unlocked windows, intrusion detection alerts you that someone has tried to open the window and crawl through. These tools provide a broad spectrum of reactive techniques, ranging from sending simple notification and taking evasive maneuvers to actively trapping an intrusion and tracing it back to its point of origin. From a technical standpoint, intrusion detection tools aren't hard to implement. The real challenge comes in determining the rules that constitute an unauthorized intrusion. Maybe it should be two.
Somebody has to decide, based on who the users are and what is at risk.
And once an intrusion has been detected, a rule tells the system what to do. Somebody has to make a management decision. Different systems, databases, and applications will require different rules. It isn't hard, but somebody still has to sit down and think through the issues and review the rules periodically to make sure they are still appropriate as things change. The third issue with maintaining system integrity is the security of the systems management tools themselves.