10:20 AM newly seen badness and other novel stuff is definitely the domain of anomaly detection and other… medium
9:50 PM Depends on what you mean — attempts to match TI to logs happen from the very small size, think… medium