SIEM focus

What are some of the use cases with PAM and SIEM capabilities/integration when it comes to tie at the endpoint level through a scripted action or another mechanism?