▲ 5 How to select right SIEM Tool? asked by damf 21 days ago Is there a framework or checklist people use for this?
Skip the framework, answer four questions.
What is the first thing you want it to catch?
Where do the logs come from on day one?
Who gets the alert at 3am?
What do you pay per GB and what happens when you go over?
If a vendor cannot get through those four in one call, that is your answer.