We didn't establish a formal performance baseline, which was a significant oversight. Functional parity was our gate, but the operational reality emerged later. The cost differential wasn't a static 20%; it was a variable risk tied to specific query patterns. For example, a rule joining authentication events against asset inventory would run predictably in Panther but would trigger sporadic, massive scans in Chronicle whenever a user with a large historical login count was evaluated. The abstraction leaked.
We had to create that baseline retroactively by logging bytes scanned per rule execution over a month, then categorizing rules by their scan volatility. It revealed that the "optimization" work was essentially building an internal performance model that the product should have provided.