OK but it's also extremely useful and the backbone of almost all incident response on Linux servers... The fact that it's a checklist really isn't relevant - no

OK but it's also extremely useful and the backbone of almost all incident response on Linux servers... The fact that it's a checklist really isn't relevant - no one is checklisting that specific system calls are instrumented, and that's not even how compliance works.