Real-time logging of suspicious connections. Automated alerts for burst activity or scan detection. Integration between honeypot and IDS modules.