best response confirmed by marc.biessy (Occasional Contributor)

If you are running all Lightweight GWs  > 1.8 , there is no additional value in incoming SIEM traffic.

ATA will read all the needed events locally.

SIEM has additional value in standalone GWs scenario, or in older version of ATA where we did not read event locally.

We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE