@GossiTheDog
Perhaps there are use-cases I'm failing to appreciate, but I just don't believe this to be true.
- Is it not turn-key enough?
- Is it that your vendor, like crowdstrike is not that good with [a specific] Linux?
- Are you mistaking threat detection, for backdooring your own users to "scan billions of events"?