The cybersecurity reality is that there’s hundreds of thousands of anomalies every day. The burden on the security analyst to chase each one and validate is too big to bear. Analysts need technology to help them deal with this overload, and have machines chase the anomaly, collect the evidence, assemble the narrative, summarize it, and present it in a way the analyst can do what he does best: Take action. Any second spent on writing queries, filtering data, pivoting tables, etc. is the second where he loses 10 gigabytes, and is a second too late.