Main sources of information for SIEM are network devices, workstations, endpoints and domain controllers. During the setup, the SIEM engineers can specify additional surfaces to monitor. There is no problem to make the software collect the information from all possible devices, but that may decrease the efficiency of the solution.