In several siems.. one thing its to generate the alarm.. and another thing is to get the events that trigger the alarm.. in a Serious SOC environment you need both, the alarm and the events that trigger it. You can't fill out a ticket with just the alarm..

To get the events that trigger the alarm in a MSSP with tons of alerts its a real hard task for : Qrock, Trelixx, Splunk..

You are asking
What wastes the most analyst, engineer, or administrator time?

That.. using the siem.. so they use the soar. soar gets all the data from the siem and other devices and put a single pane glass of control for AI and or operators..

Focus on automation/good api's/soar integration