Why does getting a SIEM to a usable state take so long?

Spent a few days recently setting up Wazuh for a client firewall rules, certs, detection tuning, indexer issues, random breakages None of it is particularly “hard”, but getting it to a point where alerts are actually meaningful (and not just noise) takes way longer than expected. - Initial deploym