Almost every SIEM regret traces to three things decided before the product was chosen: the ingest volume nobody forecast, the tuning nobody funded, and buying a platform when you needed a managed service. The pricing models and how they behave as you grow, log source prioritisation, the 24/7 staffing arithmetic, and the questions to put to a vendor.