In reply to Danny Sheaffer.

Danny, absolutely. We use netflow (with Cisco Lancope), DNS, the IDS/IPS systems, CiscoAMP, scan data, asset inventory systems, RedSeal, just to name a few. It's a huge set of data in an organized and queryable data lake, and then its regularly queried with playbooks" at least once a day - and playbooks are added/removed as needed for efficacy.

hope that helps!