New comment on reddit

Building on /u/Vlape's answer…

• what data do you have?
• how much data do you have?
• what actually matters to you/your organization?
• what kind of infrastructure is running Splunk (can it handle the Alert/Report/Dashboard load, etc, you want to run)?
• what additional data can you collect?
• what data are you collecting you don't need?
• what level of technical competency are you targeting for Alert/Report/Dashboard recipients?
• what technical competencies do the KO creators/maintainers have?
• what internal/external policies/regulations/compliances do you need to maintain?

My primary customer is alerting, based on ForeScout data, on decvices which don't belong on some subnets.

A previous customer wanted to alert whenever a print job was run from certain types of machines.

Both of those are considered "security monitoring" in the respective organizations … but monitoring print jobs at my current customer would not only be insane (1000s upon 1000s of prints per day, organization-wide), it would accomplish NOTHING.

And not because there might (or might not) be security-related data exfiltration happening via print jobs, but because the amount of that that is realistically actually happening is a few pages per month/year – tops. So the noise-to-signal ratio would be astronomical.