I am curious if you plan to add support for threat intelligence (JSON/STIX)?  This would fall nicely under compliance.  You would ingest IOC data from OSINT or even internal threat intelligence servers (like Soltra), and then match logs against IOCs to help your users identify compromised systems.