I like to use a separate tool for getting realtime event logs(Process and network connections) and using osquery to get state of a machine (whats installed, configs, keys)