In a traditional network, you have options to TAP data traffic by applying some sort of TAP device or port mirroring (SPAN). Port mirroring creates a copy of packets being transferred between two nodes via a network device. In order to provide this functionality in the cloud, you must use tap-as-a-service. When enabled and configured it will allow the system administrator to run an IDS on his tenant network. Good examples of these solutions are Phantom TAP from Ixia and Gigamon1s GigaVue. Advanced virtual switches like Cisco 1000V also support SPAN port functionality.