Your goal is to understand your network traffic better than your adversary. Logging accepted traffic can tell you
What services are in use. If there is a sudden surge in a given service that is not tied to any business initiative, this could mean that your adversary has discovered and is exploiting your network.
What your normal traffic recipients are. If you suddenly experience a 100% surge in communications from a country/region that is not tied to a business initiative, this could be a security problem, or it could be a business opportunity.
Approaching limits. If your accepted traffic rises above 85% of your network bandwidth, then you're going to have a denial of service. Could be adversarial, could be self inflicted. Doesn't matter.
If you have an insider who is exfiltrating information, you can discover it through logging accepted traffic.
If you discover a problem, a review of accepted traffic may reveal when the problem started, and what information has been compromised. This can be critical to recovery.