Summary: In the last decades linear logic became a useful logical system for various usage in computer science. Its ability to handle resources and its competence to describe dynamics of processes predetermine it for describing behavior of programs and program systems. Linear logic can be apprehended as a multiplicative and additive extension of usual logic. We show the possibilities how these fragments can be enriched to describe behavior and to achieve knowledge on an example of simplified Intrusion Detection System (IDS). We construct Kripke model over a coalgebra of modal linear logic for pursuing observable behavior of IDS. Using the same Kripke frame we show how knowledge and belief in the terms of epistemic linear logic can be achieved.