Maybe a bit off-topic but what do people actually use for monitoring/intrusion detection on small-scale to hobby projects that are internet-connected? I feel like the "established" monitoring frameworks require too much maintenance work and care to really be effective but the operating systems generally used for this kinda work have a way too large surface area to just leave running on their own. (Hello Unikernels?)