@cR0w It's a standard EDR feature? But yes, it costs hella ducats. Sysmon is free, but oh lordy the self-hosted SIEM ain't.