Do you mean help catch security events that might help you detect an intrusion or attempted intrusion, or using LEM as an IDS/IPS? I could not imagine getting LEM tuned enough to actually be the IDS/IPS! I could seeing sending IDS/IPS logs to LEM and triggering off of the logs.
As a tools to "see" intrusions though, it can be very helpful!