the most important part is figuring out how you plan to get logs from your systems (e.g. log forwarders, syslog, TLS, etc)