Which of the following is a type of intruder detection that involves logging network events to a file for an administrator to review later?

Packet detection is not a recognized IDS detection classification; it loosely describes a mechanism, not a response mode.

In passive detection mode, the IDS monitors and captures network traffic or system events and writes them to a log, but does not automatically block or alter any traffic in real time. An administrator reviews the logs at a later time to identify intrusions or anomalies. This deferred, non-interventional approach is the defining characteristic that distinguishes passive detection from active (inline) detection.

Active detection (also called inline or reactive detection) responds to threats in real time by blocking connections or generating alerts immediately, rather than simply logging for later review.

Event detection is not a standard IDS taxonomy term; it does not specifically describe the log-and-review behavior outlined in the question.