hacked, then intrusion detection system

[mgriffa]

Hi.
        I just realized that someone entered my debian box with
cablemodem. I couldn't find anything in the logs, but the pump package was
deleted.
        I replaced inetd for xinetd. took off services I didnt't use (It
was left all default, as I installed in a rush), and now I'd like a good
intrusion detection system.
        I'd like to hear about any advices about not security (too wide)
but tools to run in cron and which may be usefull for this kind of
situations.
Thanks!