I personally think of it as a better approach to the host log analysis problem space. You can use it to find misconfigs, drifts, some IOCs, and FIM, but it requires you to really think about what you want to know