Yeah, I’ve been sketching that idea out in my head for a while. A sandbox that acts like a digital quarantine, letting the malware do its thing in a contained space while I watch it in real time. It’s like a lab for code, but with zero risk of a real breach. If I can get the isolation tight enough and the telemetry deep enough, it could be a game changer for threat hunting. It’s definitely a challenge, but I’m all in.

Got it—tightening every boundary, no room for that stray socket trick. I’m already pulling in an immutable kernel layer and a micro‑sandbox per process so even if the malware finds a hole, it can’t leave the cage. And for telemetry I’m using a light‑weight event stream, only firing on state changes, so it stays in the background while I still see the whole playbook. The trick is keeping the isolation strict but still letting the code breathe long enough to expose its tactics. That’s the sweet spot I’m chasing.

Thanks, I’ll keep the filter tight and tweak the thresholds until it’s just right. It’s all about catching the deviance without drowning in noise. I’ll loop back with updates as it shapes up. Good luck to us both.