Wake me up, before you log-log (…or when September ends, whichever comes first)

This article argues that while logs remain valuable for deep investigation and evidence collection, initial alerting should rely on higher-fidelity, API-based signals to reduce false positives and speed response. Drawing on historical context and the author’s experience, it explains how Expel’s approach prioritizes contextual, actionable alerts first and uses logs selectively for enrichment and root-cause analysis.