Validating that the most relevant endpoint data is being captured and analyzed

Identifying missing, redundant and obsolete rule sets and watch lists

Measuring the time between security events occurring and alerts being generated

Flagging attacker actions that are detected but not blocked by prevention controls

Determine in a timely fashion if logs from relevant sources are being ingested

Identify and prioritize new data sources to remediate logging gaps

Ensure that logs contain the requisite level of data granularity for threat detection