As all consultants say...it depends The elements I would factor in are: 1) How they are staffed? 2) What groups outside of security will use this tool? 3) Is this for SIEM or log management? 4) Size of environment For" how are they staffed" question I think if you have…