From a technical standpoint, intrusion detection tools aren't hard to implement. The real challenge comes in determining the rules that constitute an unauthorized intrusion. Maybe it should be two. Somebody has to decide, based on who the users are and what is at risk. And once an intrusion has been detected, a rule tells the system what to do.
Somebody has to make a management decision.
Different systems, databases, and applications will require different rules. It isn't hard, but somebody still has to sit down and think through the issues and review the rules periodically to make sure they are still appropriate as things change. The third issue with maintaining system integrity is the security of the systems management tools themselves. The danger here is that these tools carry full authority. A user can shut down systems, delete files, and stir up a wide range of trouble.