Unfortunately, most major SIEM vendors charge for the amount of data being ingested, which forces many organizations to only collect data they think is worthy to pay for, instead of what data they might actually need.