[Autogenerated] Where do people fail on this one?
Uh, in a couple of places.
Um,
sometimes they can't show me all of the event data
that they need to be gathering right.
All of the event types, um,
sometimes used to be the case that organizations had a
hard time retaining all of the log data.
But storage is increasingly sort of inexpensive and
accessible so that that sort of fallen away.
The biggest thing is some sort of meaningful analysis and response, right?
I see a lot of organizations say, Oh, well,
we you know,
we use the sort of canned PC I reports right that that dig
into this database and pull stuff out, and we don't know how they work on.
We don't really know what they're telling us,
and we certainly haven't taken any efforts to sort of
tuned this to suit our environment.
And so then are we looked at the alerts,
and we're like, That's a false positive or I'll,
that's immaterial.
Or I'll That's garbage right?
And we basically trained ourselves to cry wolf and and then ignore that
its coverage of problem because obviously a lot of cloud by systems now
this required the supply supplied by systems.
Absolutely, isn't it?
Of course.
So if you're if you're procuring Cloud UNIX was needs to
procure logging from that cloud environment.
Right?
That needs to be consolidated.
Doesn't need to be consolidated with with local logs as well.
So So this is this is a tricky thing.
I think if you don't have a consolidated longer posit Torrey,
you are blinding yourself to what's actually happening.
Uh, that said the words like, consolidate your log.
Repo doesn't they don't really exist in PC IDE s s.
And there are cases where clients, for whatever reason,
have maybe a couple of different silos of blog data
that they can't or don't consolidate.
And so can you fail somebody on that?
I'm not sure you can write.
Um, does it diminish its usefulness?
I think significantly