The correlation rules and alerting speed stand out for me because they cut down the time between log spikes and action, and the alert context, when it includes related events, really helps us understand what happened without jumping between too many screens.
