[catsintrees]

Honeypot.

I've tried running an IDS system on a mini-server with 4 GB of RAM (it was ELK stack) and the whole thing burned up almost instantly. I remember running HTOP and every bar for the cores was at 100%...and I hadn't even sent any packets to it yet...

So a little HoneyPot tripwire would be best. Or maybe set up an Apache Web Server on it and see how secure you can make it. It's harder than it looks. Apache was deisgned in like 94 and gives no fucks about UX or usability or sensable configuration.