For SIEM: pick ONE log source (Windows Event 4624/4625) and learn it cold before touching anything else. Depth beats breadth here.