• Blackbox, customer requests to look at X activity, or do a hunt on the firewalls.
• A basic look at failed logins, or attempts on public internet facing devices