Detection and alerting Monitor active resources Review resources considered malicious Review changed scripts Configure alerts