SIEM solutions have users define the severity of events, which events should trigger alerts and at when, such as at what frequency or threshold