Proc - Process based analysis
This would include activity by PID, and syscall analysis.