I used to think packaged pre-cut veg at the supermarket was for lazy people.

Then a disabled person pointed out it was a lifeline for them because they lived alone and couldn’t cut it up themselves most days.

I had never even considered that. It changed my perspective and I think from then on when something seems “lazy” I always ask myself “is this just accessible?”
And it’s nearly always the latter.

It’s not hard to listen to someone when they say something is not accessible and it’s not difficult to shift your perspective.
I don’t know why so many people won’t.

For those working on managing log ingestion, it's worth taking a look at https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor if you haven't recently.

Last update was in May and it lists Windows Server eventIDs by monitoring priority.

Was working on ingestion stuff and it appears 1 event ID accounting for 60% of our Windows ingestion has no real security value.

#blueteam #siem