SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions