Great to see sysdig and falco used in this way! For another earlier discussion of monitoring the behavior of intruders using sysdig, check out https://sysdig.com/blog/fishing-for-hackers/.