Once you have a sense of your goals, we recommend that you optimize your detection during a phased, iterative implementation - start small, and broaden gradually. Typically, the biggest pitfall customers want to avoid during implementation is to get flooded by too many low priority alerts that become unmanageable - which is typically caused by taking too broad of an approach for detection. By taking the time to optimize your detection gradually during the first few weeks, your team will be set up for ongoing success.