Ask about SIEM environment

What types of data are they ingesting

What is the environment like

What data is coming in

Where is the control set

What feeds are getting in?

What are you filtering in?

How are you storing this?

What tooling are you using?

What difficulties are you facing?

What do you find difficult at the moment?

Is the tooling the right set to deliver that?