The Linux version of Crowdstrike is severely gimped compared to the Windows one though. No way you could reconstruct somebody's activity with the same detail you could from a Windows session.