Despite modern SOCs having unprecedented alert and visibility levels, translating these into actionable steps remains a labor-intensive challenge. The advent of LLMs and AI advancements provides an opportunity to rethink our security operation stacks—what data to use, where to store it, how to detect on it, how to triage it, and how to drive the proper response.