Mariana Dima

> Looking into the implementation history, there does not seem to be any explanation of why the current collection method was chosen - especially with this PR's simpler alternative. @jorgeta,...

examples in https://github.com/elastic/security-team/issues/6362