Which of the following devices BEST allows a security administrator to identify malicious activity after it has occurred?

Which of the following devices BEST allows a security administrator to identify malicious activity after it has occurred?

A.
Spam filter

B.
IDS

C.
Firewall

D.
Malware inspection