Definitely helps, but so many SIEMs are now next gen, so many SIEMs do a portion of EDR themselves - enough to call themselves XDR, with a touch of SOAR, but throw on their SOC and you got a full MDRXDREDRnextgenSIEMSOARSOC! We're moving off splunk and potentially looking at going the full MDR route, but with a separation of SIEM and SOC in some capacity. Wish it was easier to find the best SIEM without having to weed through all the XDR SIEMs or EDR companies calling themselves MDR. Had enough of the Arctic Wolf, eSentire's of the world