Ad hoc networks mostly operate over open and unprotected environments and are as such vulnerable to a wide range of attacks. Preventive techniques e.g., firewall and encryption, are no longer sufficient and should be coupled with advanced intrusion detection. We propose a distributed intrusion detection system that analyses activity logs so as to generate the rules which are used to detect intrusion. In order to deal with the distributed nature of an ad hoc network, the proposed system correlates information found in the multiple traces provided by surrounding devices. Performance is further evaluated, in terms of e.g., intruder detection rate and false positive.