I came across an article by Dr. Anton Chuvakin that I think should be required reading for all prospective SIEM customers and vendor SE's. Follow the steps he outlines in this presentation and you will greatly increase your chances for success with your first SIEM. Highly recommended.

 

http://solutions-review.com/security-information-event-management/2015/10/08/fiv e-best-and-worst-practices-for-using-sie…