Gelatinous Cube

tripwire / system reporting daemon

(alternate name medusa)

ignore some files
hash file content
list running processes
list cron jobs
list network connections
list user sessions
report data to beholder (which summarizes for trailhead, which walkstick can pull from)