A SIEM is often sold as a detection engine. It is closer to a data pipeline: what you feed it and how you tune it decides whether it helps.
Collection comes first
Detection quality is capped by log coverage. Endpoint process logs, authentication events and firewall data are the minimum useful baseline for most organisations.
Normalisation makes correlation possible
Different sources describe the same user and host differently. Consistent field mapping is what allows one rule to work across your estate.
Tuning is continuous work
A rule that fires two hundred times a day trains analysts to ignore it. Reviewing noisy detections weekly does more for security than adding new rules.
- Track alert volume per rule
- Retire rules nobody actions
- Document why each rule exists
