[_b8r0]

I'm thinking with saved and regularly run queries and reports this could take on loglogic or even low end arcsight cases.