Notification received from SIEM Connector are delayed.
The current architecture of the SIEM connector is such that it polls the sever for new events on a fixed interval (5 min default/recommended) and downloading a fixed number of events each time. Occasional burst in event volume may case connector to fall behind, because there are too many events queued up on the server side.
In many cases, the SIEM connector will catch up over a period of time as the volume of events goes down back.
In some cases, adjusting the poll interval (not less than 5 minutes) and/or download size may be needed to make the connector catch up.