Proc - Process based analysis This would include activity by PID, and syscall analysis.