Event Categories (cont'd)

• Prioritize events per category

• Cost vs. Performance

  • more events
    • slower response (volume)
    • costlier (time/resources)
  • limited events
    • threats undetected
  • balanced, manageable level