Efficiency gains within a Security Operating Centre

我想通过使用协调和自动化技术，研究安全运营中心的效率提升，包括工具集(SIEM、日志转发器、X/EDR、启用GPO等)的初始创建、部署和配置。我相信，如果新网络被怀疑已成为恶意行为者的目标，但缺乏安全工具集，拥有创建类似SOC功能的能力将大大缩短在新网络上提供高效事件响应的响应时间。

I would like to research efficiency gains within a Security Operating Centre, ranging from initial creation, deployment and configuration of tool sets (SIEM, log forwarders, X/EDR, enabling GPOs etc), through the use of orchestration and automation technologies. Having the ability to create a SOC-like functionality would, I believe greatly reduce the response time in providing efficient Incident Response on a new network if it is suspected of having been targeted by malicious actors but lacks a security toolset.