A SIEM is only as valuable as the questions you ask it

Do you have time to identify and ask the right questions? Note that these will change weekly at least, often daily. And that queries are additive—asking new questions doesn’t mean that you can stop asking most previous questions.

And most importantly, do you have time to sift through the results to find answers?