1. Understand your environment: Segments, microsegments etc. Know where everything is
2. Understand what your trying to do: Why are you monitoring, regulations? Compliance?
3. Understand your retention requirements: Storage Cost!!! Your capturing events…
