Thanks for your comment, Thomas!

A good thermometer for evaluating maturity, especially when it comes to possibly ingesting high-volume telemetry: the existence of a distinct, dedicated data engineering layer or pipeline.

I wrote about it here: https://detect.fyi/why-you-need-data-engineering-pipelines-before-an-enterprise-siem-0be553584aa9

It's nearly impossible or financially prohibitive to simply throw everything at the SIEM.