Threat Hunting and False Negatives

The more complete telemetry captured inside a network, the more chance analysts have of understanding if an attack took place. Although modern endpoint detection and response tools have alert logs and additional full capture logs for additional cost, what level of value does each bring an organization?