Just added another sensor to #sysinspect — "procnotify".

In this very short demo: as long as a new process is "bash" (use "zsh", LOL), #sysinspect SIGKILLs it.

Key points:
1. procnotify detects a new process
2. a model is getting triggered (in this case just a process killer)

Currently:
Native: #linux, #netbsd
Others: external fallback path.