At the risk of getting a bit philosophical - your situation is the nth instance of the general case of "In order to make sense of an event, I need a good approximation of the state of the world at the time of the event". SIEMs are great at recording/processing events, but we have found them cumbersome at best, impossible at worst, trying to say something about the state of the world at time x.