SIEMs can provide a wealth of detection and response capabilities, but most implementations fail to deliver promised value (while costing millions). Learn from a recovered SIEM consultant where most programmes go wrong and how to think about threat detection needs for a modern SOC. Deep technical knowledge is not required!