Network trafficExternal sensorsHost system auditing capabilitiesA host-based IDS often relies upon the host system's auditing capabilities to perform detection activities. The host-based IDS uses the logs of the local system to search for attack or intrusion activities.