Dude I'm a security consultant for a major vendor and I can't tell you the number of times I've A) Found an incident while installing new equipment B) Install

Dude I'm a security consultant for a major vendor and I can't tell you the number of times I've A) Found an incident while installing new equipment B) Installed new equipment last year and came back this year because they still got hacked and/or C) Ripped out their old gear and put in my company's gear after a hack because the sales guy told them they wouldn't get hacked with our (passive, monitor-only) gear. You need the right tools, no doubt. But you need to understand your needs first. Centralized logging is the first step, but without knowing what you want to get out of it, those logs just sit there unnoticed. Even intelligence platforms like Splunk or ArcSight, unless you know what you're looking for and write it into rules, it's just sitting there. Knowledge is what matters, the tools just make it easier.