They can add behavior analytics and AI or machine learning technology. They also improve their correlation engine. In addition to collecting logs from devices, they can collect the traffic and then correlate these logs and the traffic information. 

They can also improve a lot of rules and vulnerability assessment. For vulnerability management, they can add more features.