Looking for FLOSS platform for monitoring many remote user endpoints (varying devices and OSs) for visibility and data leak protection (eg. if notice that a particular policy is violated on a user machine (eg. attempting to email a particular document or filetype), retrieve info on what that is exactly and act on that violation).
Have been looking at SIEMs, but really don't know much about security monitoring and DLP, so not sure if this is even the right direction to go in or if there are newer, better systems. A platform that is easiest to use / manage and that has an active support community would really be a big plus.