This is serious. While IDS/IPS may be programmed to "detect" it at this point it is too late because the hacker has already obtained the keys to the kingdom. Just had a security code development seminar today with contracted pen-testers and this was a very hot topic. If Heartbeat is enabled on your server and a hacker attempts a TSL handshake with something other than a zero value after the initial "hello" than the server will send the contents of the last cached memory back to the hacker. If this is a web server running Apache, Apache will gladly package the contents of it's cache back to the server including SESSION cookies and SSL encryption keys still in memory.
The pen-testers we spoke with today said that they know of a hacker site that went up 5 hours after the notice and started exploiting web servers. They have tested this on there systems and have been able to pull SSL keys, SESSION cookies, they had everything need to open the SESSION contents where they had usernames and passwords.
My understanding is that unless IDS/IPS has been programmed to compare the incoming and outgoing handshake, there will be no log information from the server of the event. So in other words you may not know if you have been exploited or not. Worst case you have encryptions keys and and users SESSION contents out in the wild, and you find out when customer's banks fraud departments start calling.