@cR0w@infosec.exchange does the SIEM charting stop because mitigations were effective? Or because i wrote a bad rule and it was bad?