Ask about SIEM environment
What types of data are they ingesting
What is the environment like
What data is coming in
Where is the control set
What feeds are getting in?
What are you filtering in?
How are you storing this?
What tooling are you using?
What difficulties are you facing?
What do you find difficult at the moment?
Is the tooling the right set to deliver that?