What should HostLens observe next?

[VeloraTech]

HostLens currently focuses on the foundation for process and file-level host events.

The longer-term direction could include other forms of host telemetry:

• Network connections
• Command execution
• Process resource activity
• Sockets
• Additional filesystem events
• Other system-level events

But I don't want to turn HostLens into a giant collection of telemetry APIs just because they are technically possible.

The goal is to build infrastructure that developer tools can actually use.

So I'm interested in what developers would genuinely build if they had a reliable local event stream like:

process started
process opened file
process modified file
process exited
network connection started

What would you build?

For example:

• AI-agent auditing
• developer debugging tools
• security tooling
• local activity tracking
• test instrumentation
• privacy tools
• developer environment tooling
• something completely different

What event would make the biggest difference to your tool?

And perhaps more importantly:

What host-level information do you currently wish you could observe programmatically but can't easily access in a portable way?

I'm more interested in concrete use cases than feature requests.

If you have a tool that could use HostLens today, describe what you would want to consume from it.