LIke, we get process flight recording on Windows through the Windows Event Logs and secure GPO configurations, where as CB gets it natively via a kernel driver, just for an example.