The part of an Intrusion Detection System or Intrusion Prevention System that lets them tell the difference between an attack and ‘normal operations’.