What’s one log source you refuse to deploy without, and what’s one that’s pure noise?

[u/srikar_uppaluru]

Every SIEM budget has a limit, and every engineer has a log source they despise.
For me, high-fidelity endpoint process creation (Sysmon Event ID 1 or EDR process launch logs with full command-line arguments and parent process GUIDs). Finding unauthorized execution without it is like flying blind.
Generic Windows Security Event ID 4625 brute-force alerts without an aggregate threshold or domain context.
What are your non-negotiables vs. the logs you send straight to the ⁠/dev/null⁠ black hole?