In retrospect the day or two I put into #AppArmor rules *and* wiring up auditd so that audit logs trigger notifications on my phone seems… well spent. I even set it up to collect audit logs from most of my boxes centrally.

(I didn't get anything today, I don't run PHP and my stuff doesn't auto-update = no exploitable TLS clients… the latter being a bit questionable maybe.)

#auditd is an interesting piece of Linux infrastructure, if you weren't aware it exists I recommend a look!