A couple of queries which map onto expected prohibited behaviour and can be yanked into the TrueFort Reporter.
One for historical process and the other for historical network
They include entities that I would alsways look for when, in the very distant past, I was a poor system admin