SIEM expectations frequently don’t jibe with reality because many IT managers believe SIEM is about as powerful as Merlin’s wand. Organizations need to lay out the priorities of their SIEM deployments and to figure out objectives. Scalability nightmares continue to reign because SIEM tools need to be able to scale so that seemingly irrelevant information that might point to a large-scale trend is not lost. Some SIEM vendors have told their customers that it is just a matter of “tuning” the tool and ignoring “irrelevant” information.”]
Source: https://www.darkreading.com/analytics/five-reasons-siem-deployments-fail