Beyond normal system logs --- you can set up auditd to track very specific things, like executables, files being written to, copied, modified. I work on endpoi

Beyond normal system logs --- you can set up auditd to track very specific things, like executables, files being written to, copied, modified. I work on endpoint protection software that goes deeper, using ebpf and a driver for older kernels to track specific syscalls, and look for things like permission escalations, forking and then doing naughty things, for instance. It's more meant for aggregating this data to a backend that then analyzes it and provides a panel that alerts security folks to unusual behavior.