I have experience with QRadar.

We did not have a SIEM solution previously.

Our CEO was phished several times. After the third time in a month that we had to go change his password, and counsel him again on not connecting to open WiFi, we realized that...

We have on-premise Active Directory that's federated against Office 365. We have three very different log sources. We have our local AD, we have our federation service that authenticates, and then we have Office that contains all of the logs. It was very, very difficult for us to follow that chain. Time stamps are slightly different. One's in this timezone, one's in that timezone. Really, it was born out of this frustration of: I need to figure out what happened. "What did he click on? Where was he? Where did he log in from?" to establish the chain of events. I just couldn't, because I didn't have one single repository to go to.

We were previously using ArcSight. We switched because ArcSight didn't have a roadmap for their company. We didn't get a clear roadmap for their technology innovation guidelines.