Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?

'Detective' is not a standard IDS classification in recognized security frameworks; the conventional categories are passive (monitor-only) and active/inline (prevention-capable).

A passive IDS operates in monitor-only mode - it captures traffic, analyzes it against known signatures or anomalies, and sends alerts when threats are detected, but it does not interfere with the traffic flow or terminate connections. Because it has no inline prevention capability, responding to a detected attack still requires manual intervention by an administrator or a separate enforcement device.

'Intuitive' is not a recognized or defined IDS type in any security curriculum, vendor documentation, or industry standard.

A reactive IDS is one that takes automated corrective actions - such as resetting TCP sessions or dynamically updating firewall rules - in response to detected threats, making it the opposite of a monitor-only system.