CHW-4709 SIEMConfigInvalid

Default message: SIEM integration config failed validation; check name, provider, and provider-specific config fields
HTTP status: 400 (client)

Problem. Create or update rejected the SIEM integration payload with 400. Cause. A required field was missing or out of range — common failures are name blank, provider not in {splunk, sentinel, qradar, elastic}, config.hec_url missing or malformed for Splunk, config.host missing for syslog providers, config.port out of the 0–65535 range, secret missing when Splunk HEC demands it, or start_from not in {now, beginning}. The specific reason is preserved in the response message. Fix. Adjust the payload per the provider docs and retry. HTTP 400.