A SIEM tightly couples data collection, correlation rules, alerting, and case management in a single system, typically priced per GB ingested or per event per second. A security data lake separates raw storage from the analytics and detection layers, storing data in open formats on cheap object storage and connecting query engines on demand. Most mature organizations run both: the SIEM handles real-time alerting workflows, and the lake handles full-fidelity retention, threat hunting, and ML training.