Yeah so we have an osquery/streamalert pipeline with scheduled queries. We dump into ELK right now, but we are building a system for applying tags with the purpose of tuning our configs, reducing false positives, and more or less determining "what do i automate". So I guess my question is more generically, how are folks today deciding what results to take action on? My impression is that the process is still pretty manual. Kolide, for example, will give you some alerting / best practices stuff, but my intuition says that much of that process should be tied to runbooks, and once you figure out "what do I do?" the problem should turn into "how do I automate it this time and then every time hereafter?" So I guess the question is pretty generically, once you guys here have your osquery pipeline set up, how are you going about making your response plans? Maybe that's a big unknown, but we are trying to decide on meaningful tags for osquery data to support automating some response actions. Or at absolute minimum, for the purpose of alert tuning.