Logs: start with the incident question
Event volume is not investigation capability.
Security operations and evidence
Logs, detection and evidence to investigate incidents and assess controls.
Reading on this topic
Thiago Lima Soneti da Silva (Thiago Silva) — Cyber Architect and technical lead at Lima e Silva Tecnologia.