What about logging for "unknown unknowns"? For example, too many login failures may indicate an attack. Having an early warning for a breach is -- IMHO -- worth

What about logging for "unknown unknowns"? For example, too many login failures may indicate an attack. Having an early warning for a breach is -- IMHO -- worth all the performance in the world. Here is how I recommend to perform regular log reviews: https://elastisys.io/compliantkubernetes/ciso-guide/log-review/ https://elastisys.io/compliantkubernetes/ciso-guide/log-revi...