One aspect of security configuration I don't see talked about enough is verbosity vs retention.
Do you really want this event of marginal use if it makes you have 20 fewer days before logs turnover?
@SwiftOnSecurity
Arguing for short and properly managed retention periods is always an uphill battle. People really need to understand that most data doesn't have long-term value