Ask HN: Can intrusion detection be baked into the kernel?

I wanted to see if there is a Linux distribution or kernel module you can obtain that has some kind of intrusion detection and alerting built in. For example, is there a way I can receive an SMS whenever there is a user login on a box, which can not be prevented or interfered with in any way?