IPS devices that are classified as "In-line NIDS" devices use a combination of anomaly analysis, signature-based rules, and what else to identify malicious events on the network?

Firewall compatibility rules are a configuration concern for network architecture, not an analysis technique used by NIDS engines to identify malicious events.

Application analysis allows in-line NIDS devices to inspect traffic at the application layer, identifying malicious behavior within protocols such as HTTP, FTP, and DNS that anomaly detection and signatures alone may miss. This deep inspection capability is a key differentiator of modern IPS/NIDS platforms and enables detection of application-layer attacks.

ICMP and UDP active scanning is an offensive reconnaissance technique and is not a passive detection method employed by in-line NIDS devices.

MAC address filtering operates at Layer 2 and is a basic access control mechanism, not a malicious event detection technique used by NIDS.