Large-scale commodity cluster systems are finding increasing deployment in academic, research, and commercial settings. As a direct result of this popularity, cluster systems are also under increasing security threats. Unfortunately, there have been no corresponding improvements in security tools that specifically address the unique needs of cluster security. This paper describes an ongoing research effort at the National Center for Supercomputing Applications to develop tools for managing cluster security via process monitoring. We describe an extensible architecture and present details of a prototype process monitoring tool focused on intrusion detection.