Telemetry selection (log sources)
termsecurityIT support
Deciding what to collect by asking which questions must be answerable, rather than collecting whatever is available until the licence bill forces cuts.
Volume-based pricing makes this an economic decision disguised as a technical one, and the sources cut first are frequently the useful ones - proxy and DNS logs are enormous and are also where lateral movement and exfiltration become visible. The consistently high-value set is identity events, endpoint process telemetry, DNS and egress, administrative audit trails, and the cloud control plane. Every omission is a blind spot no amount of correlation can fill, which is why gaps should be recorded deliberately rather than discovered during an investigation.
Also known as: log sources, what to collect, ingest cost, blind spot