Why would you choose to write sysdig rules to alert you about unexpected, suspicious behavior (e.g. mysql server spawns a process) when you could write apparmor

Why would you choose to write sysdig rules to alert you about unexpected, suspicious behavior (e.g. mysql server spawns a process) when you could write apparmor or selinux policies that would alert you and block it?