SharePoint Sentinel -

The SharePoint Sentinel is meant to enhance visibility and control into running processes on a SharePoint server in order to prevent malicious activity. The methods suggested will:

Provide control over server processes by invoking two lists, a black and white list, which can provide an administrator tools to regulate processor activity.
Easy controls to start and halt the SharePoint Sentinel (process protection agent)
Alerts of malicious processes
Monitoring log to keep relevant records
Monitoring your server processes is a fairly important part of any security framework, be it for process auditing or just having some sort of agent that will alert you to malicious processes, similar a detection engine with AV software. Monitoring your processes can not only provide insight into providing security for your SharePoint environment, but can also tell you efficiency information such as detecting run-away processes and aggregate task usage. The fairly limited Windows Snap-In for it (within the task manager), only allows you to monitor and kill tasks, and to promote good process management there should be a method to easily place processes within a whitelist (good processes) and blacklist (bad processes), such as placing the SharePoint SSO service within the whitelist, the gatherer, or any SharePoint related processes that you are using within your farm. Following you can bootstrap other processes that you dont want to be activated and they will be protected by the Sentinel, negating the need to audit them since it would essentially provide real time protection.

The SharePoint Sentinel is split up into three main portions:

Process Management
Process Configuration
Logging