Infrastructure at a mid size company. Two hundred servers and not enough people.
We ended up doing this with a heartbeat instead. Every host logs a line every 15 minutes and the check looks for the heartbeat rather than for real events. Less elegant, far fewer false alarms around holidays.
The volume alert is the one. We had the other two and still got surprised, because each individual message was perfectly normal.
Can confirm on the firewall. Ours was more than everything else combined until we stopped storing session closes.
Same thing bit us last year. Default policy had logging set to all sessions on the allow rule and nothing on the implicit deny.
We got quoted 4x our budget by one of the big ones, then the same rep called back in December with 60% off. The whole thing is theatre. Get three quotes and make sure they know there are three.