I. Emphasize that a SIEM system must have an ability to integrate threat intelligence services that provide current information on compromise indicators and adversary tactics, techniques, and procedures (TTP) with knowledge of organizational asset criticality and usage behaviors.
II. Express the importance of enabling event data correlations with the nature of infrastructure to prioritize threats and organizational assets.