Providing security in a distributed system requires more than user authentication with passwords or digital certificates and confidentiality in data transmission. Rigorous control of the executed tasks is needed in order to prevent malicious users from breaking policies, to identify the use of stolen passwords, and also to make possible rapid detection of known attacks. In this work, a solution for intrusion detection in grid and cloud computing environment is presented in which audit data is collected from the cloud and two intrusion detection techniques are applied. Analysis for anomaly detection is performed to verify if user actions correspond to known behavior profiles and knowledge analysis is performed to verify security policy violations and known attack patterns. This approach was evaluated in terms of performance results.