I hate when I know the data I want is there, but I just can't find it. This happened to me a lot early in my career, particularly when writing Snort signatures or searching for things in a SIEM. Most tools have limited native matching capability, so it always came down to writing regular expressions to dig deeper. I avoided them like the plague.

If you miss an attacker on your network, it's probably not because you don't have enough data. It's more likely that you have too much data.

This happened to me a lot early in my career, particularly when writing Snort signatures or searching for things in a SIEM. Most tools have limited native matching capability, so it always came down to writing regular expressions to dig deeper. I avoided them like the plague.