Comment by narrowrail

It's too bad this submission didn't get more attention. It seems like these files/logs could help inform the "walls and fences" to better fight intrusion in the first place (root cause analysis). I think at the enterprise level, intrusion detection is used to help prevent intrusion in the first place. Minimizing the latency b/w these two functions seems like the thing to optimize for.