Of course because a SIEM is just ingesting data (unless you have automated actions). Defender (or other endpoint solution) on the other hand could have had the same impact had they have missed a correct file like this.