Oh, one other great feature. There's no on-prem option besides the collectors. So someone can't get the bright idea to take it in-house (like with Splunk), wasting the time of a principle engineer for months on a project that doesn't make us any money.

I'll outsource SIEM every time and sleep very well doing it.