Why not just level 3?
ciberesponce opened this issue · 1 comments
ciberesponce commented
Level 3 gives you the warnings--level 2 will be very noisy. If you do level 2, it would require additional analytics after collection (i.e. at the WEC) to make use of them...
Thoughts?
iadgovuser1 commented
Are you talking about a specific subscription? In some cases we may collect extra events and then filter them more on the collection server.