Your SIEM has never been asked a question it could fail

You run your own SIEM instead of buying a managed service because the maths worked. Licences, one...