Comment by belikebakar

kernel state maps vs event buffering is an interesting choice. We've been seeing more in-memory malware in our CI/CD pipelines lately that never touches disk or network - any thoughts on extending this to userspace memory introspection?