1. A system comprising: one or more processors; and a kernel-level security agent configured to be executed by the one or more processors to observe events, filter the observed events using configurable filters, route the filtered events to one or more kernel-mode event consumers, and utilize the one or more kernel-mode event consumers to take action based at least on one of the filtered events.