server monitoring / intrusion detection for home NAS

I'm looking for some kind of monitor or intrusion detection to monitor my NAS. The following things I would like to monitor: 1. Incoming network traffic (source -> Router -> NAS) from another 1. country -> E-Mail Alert New users have been created on the system -> 1. E-Mail Alert Unexpectedly high I / O load -> E-Mail Alert monitoring 1. service (Apache, MySQL, etc.) -> E-Mail Alert / Service restart The service monitoring, point 4, I could solve with Monit . But what about the other points? Is there something ready or does anyone have ideas how something could work together, for example, with Monit? For example, to point 2, I would like to observe changes to a file which all users may update, e.g., passwd. I am grateful for suggestions or solutions.