#sigma rules

One agent to watch a mixed Windows and Linux fleet, finally

I ran a small mixed-fleet shop for two years with one Windows EDR (endpoint detection and response, software that watches a machine for suspicious activity and reports it back to a central…