I do not think there is an FAQ out there that has common rules or best practices for the LEM product specifically. You can probable find some stuff that is SIEM generic though out there somewhere. There is a new class they started a few months ago that is an intro to LEM. I would encourage anyone using LEM to attend the class. The first half is about installing and configuring of the VM and stuff like that, but there are even some good details and important information in there. The second half they get into some of the more basic stuff of LEM. I hope they bring out another couple of level of the class soon that go more nDepth (see what I did there? ) on how to use LEM and some of the more advanced features of it.
