Until recently hardware, tools, and applications have been focused not only on the tasks for which they were designed for but also on using and managing data for these tasks. This means that teams continually pull and replicate the same data over and over in order to do the analysis needed to perform their specific tasks, which has resulted in duplicative and siloed information throughout the organization. This continual recall, storage, and processing of data is expensive in terms of costs and resources and with the current rate of data expansion is quickly becoming untenable. These costs can be mitigated by flipping the focus from tool-centric to data-centric. Data-centricity not only makes business and operational sense, but (for government organizations) is part of the M-21-31 guidance. That document’s focus on centralized access and visibility for security operation centers (SOC) and the need to quickly share information will require a shift in how data is accessed and used.