I do have a log reading / action / resolution product in the works.

Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.

Also works with local models well enough.

And if you remove it, it installs itself right back. For uninstall instructions see the infamous McAfee video.