thanks for good article.that is the same problem i am experiencing in our SOC.too many sensors and too many UI cause we spent too much time just to find how is attack going to do with our network , still can't acting fast and time-to-detection & response is high .