A SIEM must be evaluated using indicators.
For example :
MTTD
Mean Time To Detect
Average time required to detect an incident.
MTTA
Mean Time To Acknowledge
Average time before the alert is taken into account.
MTTR
Mean Time To Respond/Recover
Average time required to respond or restore the situation, according to the definition used.
Other indicators:
- number of alerts
- false positive rate
- estimated false negative rate
- number of confirmed incidents
- MITRE ATT&CK cover
- investigation time
- asset coverage
- collection availability
- log quality.