Currently we do not collect all the host logs - audit,sshd etc.
We need to look into what we are currently collecting from the nodes , as well as decide what should we forward and if any should be conditioned.