I wondered if it makes sense to offer a service that runs directly on individual servers, monitors network (and possibly system) activity there and uses a combination of rules, indicators and machine learning to detect and possible react to anomalies or attacks.

Would this be valuable for your business? How much would you pay for this? Do you know any vendors that offer something similar already? Is there an open-source alternative that is "good enough" for your use case?