Investigating server compromises with cgroups: A Linux DFIR primer Red Canary By: Thomas Gardner 13 May 2026 at 15:01 Used primarily for resource management, cgroups unlock valuable telemetry for investigating malicious processes on Linux