What does a host-based IDS use for analysis?

The agent scrutinizes event logs, critical system files, and other auditable resources.