That's making the mistake of assuming these reports were unique in some way, as opposed to being part of a stream of thousands of other reports, some including even more threatening implications.
In low signal, high noise scenarios, the hindsight bias is not saying "We should have known this meant something," but rather saying "We should have given this particular thing more attention."
In our world, it happens with logs. Post- or during an incident, reading back through a log to find the culprit is trivial.
But how easy is it to have a log continually dump to your terminal, all day, for weeks, months, years, and identify the root cause line as it happens and before other monitoring tripwires go off?
In low signal, high noise scenarios, the hindsight bias is not saying "We should have known this meant something," but rather saying "We should have given this particular thing more attention."
In our world, it happens with logs. Post- or during an incident, reading back through a log to find the culprit is trivial.
But how easy is it to have a log continually dump to your terminal, all day, for weeks, months, years, and identify the root cause line as it happens and before other monitoring tripwires go off?