Logs, SIEM, then planning

It seems so simple, at first. Then, things break down, I suspect because I start doing long before I start planning. If I were to stop and write it down first, it would probably look something like this: Make a list of devices on your network that a...