(we can potentially add dozens of boxes in a day, all these reports go to central logging and then a siem, a few hundred alerts every day about new users being created, etc, is not helpful)