I think Scott's points from the Q&A in that video could be applicable to this as well - (using his terms) for a telemetry tool you either want alerting, sweeping, or forensics/incident response ('pull drive and image it')