A mature SOC doesn't mean 10 screens and 20 analysts. For SMB / mid-market, a functional 24/7 SOC is built with open-source stack.
Implemented stack
- Wazuh SIEM, Suricata IDS/IPS, Snort 3, CrowdSec, Grafana+Loki, TheHive+Cortex
What real "24/7" means
Not people awake 24h. 24/7 automated detection, triage, <15 min human response for P1/P2 via on-call rotation.