Making a large amount of this kind of data operational in real time seems like a large task. I'm wondering if it's mostly used as a postmortem tool to determine

Making a large amount of this kind of data operational in real time seems like a large task. I'm wondering if it's mostly used as a postmortem tool to determine the attack vector and close that hole going forward. Also I am interested to know if this data would fall under GDPR for any employees in the EU, and if so, how that data could be scrubbed if the employee left the company. In the US it's assumed that any information about actions on corporate hardware is owned by the company, but maybe that's not true outside US borders.