Best practices for SIEM?

One of my new clients has several solutions in place, but no SIEM. This includes Palo Alto Next-Generation Firewalls as network security, Trend Micro: Deep Security as anti-virus, and Qualys as threat &vulnerability management (TVM).

What are the best practice(s) on information gathering without a SIEM? Apologies if this is too vague. If there is anything I'm missing to mention, by all means, let me know.

Before the potential most liked comment is dropped, I'll answer it: "Best practice is …

best practices cybersecurity practices siem