- Monitor selected processes - Monitor CPU (a bit hard to have a good data - since it just peaks in most cases. Maybe monitor the long running high usage) - Monitor network? Maybe summary of the "hack" attempts