Great article. I'd also recommend people take a look at ThreatStack for aggregating syscall events: https://www.threatstack.com/.