@SwiftOnSecurity I have never been to a place with too few logs in their SIEM. They are regularly missing one or two critical logs, but they are never at a point where they understand, or can action, everything they have.