Great to see sysdig and falco used in this way! For another earlier discussion of monitoring the behavior of intruders using sysdig, check out <a href="https://sysdig.com/blog/fishing-for-hackers/" rel="nofollow">https://sysdig.com/blog/fishing-for-hackers/</a>.