A retrofittable intrusion detection unit for a window or for a door, which window or door has a frame, a leaf pivotable with respect to the frame between a closed position and an open position, and a rebate gap extending between the frame and the leaf, said retrofittable intrusion detection unit comprising a base module; and at least one counter-element associated with the base module, with the base module and the counter-element being configured to be installed in the rebate gap of the window or of the door at the frame, on the one hand, and at the leaf, on the other hand, in an opposite position with respect to one another, wherein the base module comprises: - a leaf position switch which is configured to generate a binary open switching signal or closed switching signal in dependence on the position of the leaf; and - a leaf offset sensor which is configured to generate a gradually varying leaf position signal in dependence on the position of the leaf; wherein the intrusion detection unit further comprises: - an evaluation and control device for evaluating the switching signal of the leaf position switch and the leaf position signal of the leaf offset sensor; and - a communication device for communicating with an alarm center; wherein the evaluation and control device is configured to check, based on the switching signal of the leaf position switch in a closed position check, whether the leaf adopts the closed position and to perform a monitoring operation in the event of a positive result of the closed position check; and wherein the evaluation and control device is configured, in the monitoring mode, - to determine a current value of the leaf position signal of the leaf offset sensor in a cyclically repeating manner and to check in a prying-open attempt check whether the current value of the leaf position signal or a value derived therefrom reaches a trigger threshold value; - to generate a prying-open attempt status signal in dependence on a positive result of the prying-open attempt check; and - to transmit the prying-open attempt status signal to the alarm center by means of the communication device; wherein the intrusion detection unit further has an extension module and at least one further counter-element associated with the extension module, with the extension module and the further counter-element being configured to be installed in the rebate gap of the window or of the door at the frame, on the one hand, and at the leaf, on the other hand, in an opposite position with respect to one another; wherein the base module and the extension module are positioned or can be positioned remote from one another and in an orientation of 90° relative to one another; wherein the extension module has a further leaf position switch which is configured to generate a further binary open switching signal or closed switching signal in dependence on the position of the further counter-element; and wherein the evaluation and control device is configured to check, based on the switching signal of the leaf position switch of the base module and on the further switching signal of the further leaf position switch of the extension module, whether the leaf adopts the closed position, the open position or a tilt position. - a leaf position switch which is configured to generate a binary open switching signal or closed switching signal in dependence on the position of the leaf; and - a leaf offset sensor which is configured to generate a gradually varying leaf position signal in dependence on the position of the leaf; - an evaluation and control device for evaluating the switching signal of the leaf position switch and the leaf position signal of the leaf offset sensor; and - a communication device for communicating with an alarm center; - to determine a current value of the leaf position signal of the leaf offset sensor in a cyclically repeating manner and to check in a prying-open attempt check whether the current value of the leaf position signal or a value derived therefrom reaches a trigger threshold value; - to generate a prying-open attempt status signal in dependence on a positive result of the prying-open attempt check; and - to transmit the prying-open attempt status signal to the alarm center by means of the communication device;