Efficiency gains within a Security Operating Centre

I would like to research efficiency gains within a Security Operating Centre, ranging from initial creation, deployment and configuration of tool sets (SIEM, log forwarders, X/EDR, enabling GPOs etc), through the use of orchestration and automation technologies. Having the ability to create a SOC-like functionality would, I believe greatly reduce the response time in providing efficient Incident Response on a new network if it is suspected of having been targeted by malicious actors but lacks a security toolset.