sure, IOC monitoring can be done via osquery (free), or tanium ($$$). You just have to build your own ruleset to pickup IOCs. Linux has AV, and nextgen stuff l

sure, IOC monitoring can be done via osquery (free), or tanium ($$$). You just have to build your own ruleset to pickup IOCs. Linux has AV, and nextgen stuff like Cylance (works but super buggy, runs as a kernel module). You also have other HIDS, like bro, snort, and so on, but those mostly look for suspicious network traffic. Microsoft OMS has been making some plays here, it frequently flags unusually process execution for me (eg: Python running from an uncommon path or some such)