Good input, yeah after seeing the demo I've also noticed that the anomaly detection monitoring cannot be solved by simply pointing to a process.

I'd suggest aggregating the data of vmstat,ps,lsof,nc etc. into a simplified and abstract summary by incorparating a structure based AI model, like HTM.

You could build rules and action lists and anomaly type lists, then let the AI categorize anomalies by pattern and structure detection. Heck you could go much further, ie. building an NLP query interface.. Don't get me wrong, I don't want to smoke your brain, it's just what I would do. Keep working on it!