On: eBPF on Windows

[Genbox]

Sysinternal's Process Monitor does that from a process perspective: https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

There is also System Monitor which logs the events to EventLog: https://docs.microsoft.com/en-us/sysinternals/downloads/sysm...

Are those not enough?

[GordonS → Genbox]

Process Monitor is a great utility, but I need programmatic access to this information.

SysMon is a great tool, but the license prevents distribution (such as bundling with an installer) - users must download it from Microsoft.