Spot on analysis. Relying solely on host-level telemetry creates a massive blind spot once administrative privileges are compromised. The point about retaining flow metadata for post-incident correlation is critical: wire data rarely lies when host logs are wiped. Great practical breakdown!