I think in reality, the difference between SIEM and Log management systems is a little blurry. However, using the conceptual model presented above, why would I not just take the SIEM correlation rules of the "information already known" and create scheduled queries in the log management system? Based on my experience, that would be plenty "real time" enough to meet the vast majority of needs.