Log management. Specifically tracking what you are currently ingesting vs what you could be. Basically a visibility dashboard. Another is automated testing of

Log management. Specifically tracking what you are currently ingesting vs what you could be. Basically a visibility dashboard. Another is automated testing of detections on a regular basis. Although some people are doing this with the automated pentests and stuff. I would like to see a platform that imports your current rules and generates attacks based off of them. Then it can run once a month to make sure your alerts are firing.