From kernel event capture to rule evaluation, alerting and forwarding — the full Fibratus detection pipeline.