Passive traffic monitoring
Another way to add to an IPS solution is to use a Passive Vulnerability Scanner (PVS). Rather than looking for attack traffic, PVS solutions collect packets and look for traffic or handshake data (such as JA3, SSH fingerprints, or anything it can collect in clear text) that might help identify operating systems or applications in play. You can use this method to identify problem applications that might not appear using other methods, or even hosts that were missed using other inventory methods.
For instance, a PVS solution might identify out-of-date browsers or SSH clients. SSH clients on Windows are often out of date, as many of the more prevalent clients (such as PuTTY) don't have auto-update capabilities.
PVS solutions are also great tools for finding hosts that might not have been inventoried. If it reaches out to the internet or even to other internal hosts, PVS tools can collect a surprising amount of data just from "stray" packets...
