## 1 Introduction  
Security Operations Centers (SOCs) continue to capture the attention of researchers, with widespread adoption by companies for real-time detection and response to cyber-attacks. A SOC can be defined as the integration of human resources, processes, and technologies aimed at helping businesses maintain cyber situational awareness, address compliance issues, and manage threats effectively [1, 2]. SOCs vary in scale and scope, from smaller, internally managed setups to large operations staffed by numerous analysts working around the clock. Most SOCs operate as managed services because establishing and maintaining an in-house SOC can be prohibitively expensive. Organizations that cannot afford their own SOC often rely on third-party service providers or managed security service providers (MSSPs) to deliver SOC services. Businesses adopt SOC services to meet their specific needs and resources to prevent attacks. Various SOC categories are defined and tailored to address the unique security requirements of customers and information systems [3]. Previous studies on SOCs indicate that people, processes, and technology are central to a SOC, and its success depends on these socio-technical systems [4]. A properly implemented SOC will give you the resources to detect actively and proactively and engage in an active investigation. The aim is to have a coordinated SOC human resource with the right toolset to support the analysts and incident responders and clear processes and documentation of the whole SOC scope [5]. If you have great toolsets but people do not have the skills to make proper, effective use of them, then you are in a bad position [6]. But if you expect to just hire smart people and do not give them the tools that they require to make the best use of their skills, then you are going to have something that is equally ineffective. Our previous study worked on the SOC challenges and capabilities using a survey-based study, and we focused on the human factor as the backbone of SOC [7, 8]. We conducted a performance metrics assessment, and we proposed an improvement model to consider all the factors impacting the metrics for accurate assessment [9]. However, assuming the decomposability of the Security Operations Center and then focusing attention solely on one SOC analyst as the weakest link is unrealistic, given the complex and evolving nature of SOC systems. When we target the technology factor inside the SOC, many documents are inherently commercial as they aim to inform potential customers about the SIEM products and persuade them to make a purchase, and some research papers or reports might be sponsored by commercial entities, which could influence the content to favor certain technologies or services [10]. In our work, we will shed light on the technical aspects of the SOC and focus on the SIEM deployment and the integration with the existing device products to guarantee an acceptable security coverage threshold based on the potential use case coverage. The integration of data sources into the Security Information and Event Management (SIEM) system and the implementation of use cases are crucial for enhancing cybersecurity operations and response mechanisms. By integrating a wide range of log sources into the SIEM and implementing well-designed use cases, SOCs can significantly enhance their ability to detect and respond to cybersecurity threats in a timely and effective manner. In the context of Security Operations Centers (SOCs), the MITRE ATT&CK framework serves as a critical tool for enhancing threat intelligence, security monitoring, incident response, and defensive strategies. It enables SOC teams to better understand threat actor behaviors, map out attack patterns, and prioritize their defensive measures based on tactics and techniques [11]. This paper seeks to thoroughly explore how organizations can gain a comprehensive understanding of the threat detection capabilities of their SOC and the SOC use cases, as well as identify and address any potential knowledge gaps.