Which Host-based IDS (HIDS) method of log monitoring utilizes a list of keywords or phrases that define the events of interest for the analyst, then takes a list of keywords to watch for and…

Passive analysis refers to monitoring that does not actively intervene or respond, and is not specifically characterized by keyword-triggered alerting against log files.

Retroactive analysis involves reviewing historical log data after an event has already occurred, rather than performing real-time keyword-based alerting.

Exclusive analysis filters out or ignores predefined log events using an exclusion list, which is the conceptual opposite of inclusive keyword matching.

Inclusive analysis is a HIDS log monitoring technique that defines a specific list of keywords or phrases representing security events of interest, then continuously scans log files and generates alerts whenever those terms are matched. It is called 'inclusive' because it works by including - actively watching for - predefined patterns of interest. This approach is effective for detecting known attack signatures or suspicious behavioral patterns in log data.