RAGTAGS

This category deals with how well your system can detect and respond to suspicious activity. Most breaches aren’t caught because of lack of alerts - they’re caught because something looked wrong, and someone was paying attention.