What it doesCatch suspicious instructions before they spread.Permissionsevent:readfilesystem:readdecision:writemodel:invokeaudit:writelog:writesignal:writenotification:send