In this working paper, authors Landmesser and Vommi explore weaknesses in machine learning systems used by a SIEM that present a technical issue, which can also negatively influence decisions made by SOC personnel. Incorrect ML classifications from APT attacks result in incorrect security decisions based on SIEM output, causing an even more damaging impact on required incident response.