Wireless Sensor Network (WSN) technology is being increasingly used for data collection in Critical Infrastructures (CIs). The paper presents an Intrusion Detection System (IDS), which is able to protect a CI from attacks directed to its WSN-based parts. By providing accurate and timely detection of malicious activities, the proposed IDS solution ultimately results in a dramatic improvement in terms of protection, since opportunities are given for performing proper remediation/reconfiguration actions, which counter the attack and/or allow the system to tolerate it. We present the basic ideas, discuss the main implementation issues, and perform a preliminary experimental campaign. Not only have experiments demonstrated the effectiveness of the proposed approach in protecting the system against two very serious attacks to WSNs (namely: sinkhole, and bogus packet), but they have also proved that the stringent requirements (in terms of limited availability of resources) which are typical of current state-of-the-art WSN technologies, are met.