So what does your organisation use for intrusion detection? Humans eyeballing logs doesn't scale. Rule-based approaches?