## Network (NIDS) vs Host (HIDS)

You need both.

### NIDS (Suricata, Snort, Zeek)
*   **View**: The Network Wire.
*   **Blindspot**: **Encryption (TLS/SSL)**.
    *   If the attacker uses HTTPS, the NIDS sees garbage ciphertext. It cannot detect the SQL Injection inside the SSL tunnel (unless you use SSL Termination).

### HIDS (Wazuh, OSSEC, CrowdStrike)
*   **View**: The Endpoint (OS).
*   **Advantage**: It sees the data *after* decryption.
*   **Advantage 2**: It sees local files and logs.
*   **Example**: NIDS sees encrypted traffic. HIDS sees `cmd.exe` being spawned by IIS. HIDS wins here.

### Deployment Strategy
1.  **NIDS** at the gateway to filter massive noise.
2.  **HIDS** on every server to catch what slips through.