Detection Engineering - You Don't Want to Look at Every Ten, Right?

A, i think we're filtering too much left in detection engineering. Like y, like i think of power shell, filter left, right? It's like a pass things through the like instances through the pipe line if you don't have to,. Because it takes its a less efficient. Am, but i mean, like, that's also because it's cheap, cheaper in terms of cost and resource. A,  you probably want to look at a sub set of tins, a few tens, every once in a while, right? And i think a like to day, where we just alert on that this service, this registry key was created other by a process oth