Comment by JacobiX

The idea is quite interesting, but it would be more useful if we could perform an action when a threat is detected. For example, in the network module, we can use the eBPF-provided actions: drop, forward, or log.