@kemotep In my case ($dayjob) we have a few dozen FreeBSD iron with a few hundred jails. It's managed by Puppet (config mgmt), so e.g. locking a user happens across the "fleet" fairly automagically. We ship syslogs and kernel audit logs to a log server where it can either be "looked at" by scripts/tools locally or forwarded to some SIEM tool (doesn't matter which, but there are few of them in ports, sadly). Big exception to this rule (for config mgmt in particular) currently include firewalls and routers, as for now they are "few enough" - but even that is beginning to be a pain point, so we may have to build something there. Smarter people use even better tools. Or just people who built their infra this side of 2015..