What’s the best approach to using rules in SIEMs? Do security-focused SMBs and enterprises need more rules or fewer? What role are rules likely to play in future solutions for threat detection?