I'm collecting as little as possible, we don't take the 'haystack' approach because there's currently no SLO or KPI or OKR (or quarterly goal to not be buzz-wordy) driven by things relating to the majority of pack-returned data, and there's a bunch of other agents/scanners purportedly doing things that we bought them to do. I only ship 2 queries (and their snapshot equivalents to 'catchup' within the retention period) at all