But as the article points out, it’s not the SIEM that’s the cost, it’s the labour cost for installing, tuning and monitoring it.

Not to mention, to see what’s happening, you need to dial up logging verbosity to 11 which then adds more load to the system.

So, it’s not an easy choice to make