I primarily use it as a tool to aggregate logs, alerts, and to proactively audit configurations.

It's great at finding people who can't remember passwords or misbehaving services or software.