Security operations are entering an important transition. For years, the SIEM has been the center of the SOC. It collects telemetry, correlates events, generates alerts, and gives analysts a place to investigate. But the assumptions behind that model are breaking down.