In almost every network monitoring or SIEM model there is an initial phase of "planning". This would be where you want to scope out what you want to collect from where. The Securosis guys stated in their NSO Quant report "Collect alerts and log records".

I have a basic list of things that fall into this category, logins, reboots, av process crashes... and some more simple things to gather. I feel like I am missing a chunk of things to grab. What do you guys correlate or collect?

Maybe I am looking at it from too big of a perspective and should try to break it down into domains (workstations, network infra, servers).

The issue I have is that I am aware that I should be monitoring SQL logs for "something". I just don't know what that something is quite yet because I am no SQL guru. The same can be said for other technologies and pieces of equipment.