What is a common mistake with security logging and threat detection in Cloud Security?

Collecting logs without retention, correlation, alerts, ownership, or response procedures creates cost without useful detection. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.