Incident Response: Focus on Big Value, Not Big Data

My next piece in SecurityWeek entitled "Incident Response: Focus on Big Value, Not Big Data" is out: http://www.securityweek.com/incident-response-focus-big-value-not-big-data.  With this piece, I am trying to raise awareness of the difference between data value and data volume.  All too often, I see organizations run to collect as much data as they possibly can.  Unfortunately, this is often done without thinking about the value and relevance of each data source to security operations and incident response.  This can result in a disorganized, haphazard storm of uncoordinated data sources that actually impedes security operations and incident response.  There is a better way.  Have a look and let me know what you think.