It depends on attack surface and what tooling you already have in place. But for example: > Finding suspicious outbound network activity https://blog.rapid7.c

It depends on attack surface and what tooling you already have in place. But for example: > Finding suspicious outbound network activity https://blog.rapid7.com/2016/05/09/introduction-to-osquery-for-threat-detection-dfir/ https://blog.rapid7.com/2016/05/09/introduction-to-osquery-f...