MDAATHIL/threat_detection_module ? reverse-engineered prompt

Build me a simple Python based threat detection tool for Linux that watches for suspicious activity and logs what it finds.

I want it to collect security related events, scan running processes, check for risky files or artifacts, and compare activity against a baseline so it can spot unusual behavior. It should save results in a small local database, read rules from a simple YAML policy file, and give clear output when something looks dangerous. If it makes sense, include an integration with audit logs so it can pick up system events too.

Keep it practical and easy to run from the command line, with separate pieces for collecting data, scanning processes, scanning artifacts, and handling the database. Make the code clean and simple since this is for a final year project, and add a basic README style usage example. If you need to check current docs or best practices online, go ahead and look them up.