Methods and apparatus for providing inline network traffic monitoring such as intrusion detection to clients of a provider network. A client can configure new or existing components and specify that traffic monitoring be added on or at the components in the client's configuration on the provider network. Traffic monitoring is automatically and transparently added to the client's configuration on or at the components. Traffic to the client's configuration passes through the traffic monitoring technology. Traffic monitoring technology may be implemented on a resource in the client's configuration that implements other technology, such as a load balancer component. Alternatively, traffic monitoring technology may be implemented on separate components upstream or downstream of a resource that implements other technology. Traffic monitoring may be implemented at a network substrate level rather than at an overlay network level.