Is Wiz DIR enough for a 24/7 SOC, or do you still need a SIEM?

Been digging into Wiz's Cloud Detection and Response (CDR) for the last few weeks, and I'm impressed. The agentless scanning, the CSPM posture stuff, the vulnerability graphs—it's solid. But here's my 3am thought: they position CDR as a detection engine. If I'm building a 24/7 SOC, can I just run my entire detection and response workflow from Wiz, or is a traditional SIEM (Splunk, Sentinel, etc.) still non-negotiable?

From my dashboards, Wiz CDR gives you:
* **Alerts** from cloud activity (e.g., suspicious IAM call, new internet-facing storage bucket).
* **Context** tied directly to resources (the infamous "graph").
* **Some** log ingestion for audit trails from major cloud providers.

But when I compare it to my SIEM alert rules, I start seeing gaps. A SIEM typically ingests:
* Endpoint logs (EDR)
* On-prem firewall/network flows
* Custom app logs
* Identity provider logs outside the cloud (Okta, AD)
* Email security gateway alerts

So, is Wiz CDR enough? Or is it more of a fantastic *source* for a SIEM, which then does the heavy lifting of correlation across *all* data sources?

For example, here's a simplified SIEM rule I'd have for lateral movement that Wiz alone might miss:
```yaml
# Pseudo-rule for detecting cloud cred abuse from a compromised endpoint
detection:
source_category: endpoint
event: "Process Execution"
image: "cmd.exe"
command_line: "aws s3 ls"
followed_by:
source_category: cloud
event: "AssumeRole"
user_agent: "aws-cli"
within: "2 minutes"
```

Can Wiz CDR, with its current log scope, see that first endpoint event? Probably not. So does that mean the SOC is blind to hybrid attack chains unless the SIEM ties it together?

Would love to hear from anyone running Wiz in a SOC shift. Are you piping all Wiz findings **into** a SIEM? Or have you managed to make Wiz the central console? What's your alerting workflow look like?