The essential steps for leaders to establish or improve an incident detection and response (IDR) or SOC function. Key topics include defining and prioritizing assets, identifying attack scenarios, determining indications of attack and compromise, and choosing the right SIEM tools.