An important distinction needs to be made.
The SIEM primarily improves:
visibility.
Visibility allows for improvement:
- detection;
- the investigation;
- the answer;
- governance.
But visibility alone is not enough.
We can have:
100% visibility + 0 response capacity = consistently high risk. Therefore, the SIEM must be integrated into an operational system.