/root
/var/log/messages
More
Use tab to navigate through the menu items.
SPLUNK PILL 101-#AA02-Process change
SPLUNK PILL 101-#AA01-External device
SPLUNK PILL 101-#AA00-Possible ransomware
Entropy
user id
