Yep Ronan, It is the madness of i/ disabling XCMD and than ii/ giving all functions to rebuild those in own code iii/ disabling it again introducing locked states iv/ adding the information in WH approach using  arm/eventmanager VM tools. Somebody must have lost the vision and direction with IT insights and now going around like a dog for his own tail. At the same time other tools are getting on to the market thiese can be the SIEM big data analytics area (many tools). These are implementing all the auditing at the OS level. We could see the days monitoring of SAS usage an other tools at OS level and doing the analytics with any of those leaders (all not SAS) http://securityintelligence.com/gartner-2014-magic-quadrant-siem-security/#.VVJsgKUcSUl http://securityintelligence.com/gartner-2014-magic-quadrant-siem-security/#.VVJsI6UcSUk ... View more