Security operations centre
People, detections, and a queue. A room full of screens is optional. Ownership of after-hours is not.
A SOC triages alerts, investigates, hunts, and hands genuine incidents to IR. It can be in-house, co-sourced, or an MSSP. The model is less important than coverage and authority.
Measure time-to-triage, false-positive rate, and whether detections map to your actual crown jewels. Do not measure tickets closed.
If the SOC cannot isolate a host or disable an account without a three-day CAB, you bought a reporting function.