I think we're saying the same thing. If a scheduled log management query is the rough equivalent to a SIEM correlation rule, then why not just dump the SIEM altogether? You could get the best of both worlds with the log management solution.

Thanks for the article. It is the exact decision I'm pondering at the moment.