Controls & technical basics
A watcher that inspects network traffic or a machine's activity and warns when it spots signs of an attack - without stopping it.
Formal
A system that examines copies of network packets or activity on a host, compares them against known attack patterns or normal behaviour, and reports matches as alerts while leaving the traffic itself untouched.
In plain English
Like a burglar alarm - it rings when someone breaks in, but it does not lock the door.
In practice
At a regional hospital, the IDS sees a PC in the finance office trying to reach hundreds of other machines within seconds and sends an alert to the SIEM, where the on-duty analyst decides what to do.
Why it matters
Because it only watches, it can be placed almost anywhere without risk of blocking real work - but someone must act on its warnings, or they are worth nothing.