You say "Furthermore, in testing we found the performance to be hugely better in the SIEM.". Surely that's a reason to keep the SIEM?