which, if you have sufficiently large/private intel, shipping it to agents is not acceptable. if you have sufficiently large results sets, shipping all of the events to a server is not acceptable.