Vendor lineage
LogRhythm - the SIEM problem, stated honestly
Collecting everything is easy; the cost is that somebody has to read it.
LogRhythm builds security information and event management - the category that centralises logs from an estate and tries to turn them into detections. The technology is well understood and the failure mode is organisational: a SIEM is only as good as the attention it receives, and attention is the scarcest resource in any security team.
The economics are the part worth knowing. Ingesting more data improves detection and increases both cost and noise, so every SIEM deployment converges on the same argument about what not to collect - an argument that is usually settled by licensing rather than by threat modelling.
And the failure is quiet: an alert nobody triages is indistinguishable from an alert that never fired, which is why SIEM maturity is measured in closed cases rather than in sources connected.