Thanks for the useful specific insight, as Internet is full of executive-type opinions about doing SIEM, without mentioning any technical detail.