How do you test if your SIEM is actually catching what it claims to?

The dashboard shows everything is healthy: alerts are flowing, rules are enabled, coverage looks decent on paper. But I have a nagging feeling that we have blind spots. Every time we walk through a realistic attack path, we find gaps. Some systems aren't sending the right logs. Some fields aren't parsed. Some rules have conditions that never match...