The operational task
Begin with patching, limited exposure, account/SSH policy, backups, and a service inventory. Assign a monitoring owner and recovery path.
What the implementation supports
Install a verified release, configure collectors, and verify host/authentication events arrive. Runtime and ransomware checks depend on those observations and OS capabilities.
Integration and limits
No universal sixty-minute hardening or five-minute protection guarantee is established. The scan command consumes payloads; it does not automatically test every web endpoint.
Check collector wiring, the current event schema, and the enforcing component before relying on a response. Preserve the original event and verify the result on your actual deployment. An emitted alert does not prove that the initiating operation was stopped.