SOC

A security operations centre is people with defined roles, practised procedures and tools, in that order of importance.

The tooling is the visible part and the least decisive. What determines whether a SOC works is whether the people know what to do, whether the procedures have been rehearsed, and whether anybody is accountable for the alerts nobody investigated. Plenty of organisations have bought the room and the screens without the other two.