that always seems to be the big one, Ossec is what i have used in the past for that, but it needs syscheck and constant tuning. Tanium can't get contents cause it runs off auditd