For people that self-host and manage security themselves, what steps do you take to actively monitor that you haven't been hacked?

I understand how people would set up their own backups and automate security updates, but what do you do to monitor that there hasn't been an intrusion without you noticing (e.g. login attempts, successful logins that aren't you, files changed, root kits, data stolen)? How does that compare to what managed services and hosting companies with teams who benefit from economies of scale would do for you?