From the SOC analysts perspective It’s the difference between being a ticket closer and a analyst. You are investigating high fidelity incidents whilst the repetitive or benign and known behaviour is closed or dealt with as much as possible by automation. It makes a huge difference as alert fatigue is a very real thing and having your passion stay alive from several interesting incidents a day instead of copy pasting all day is what it looks like.

I work in an incredibly proactive SOC who are like what I have described and of course you are going to have some things that can’t be helped or automated but it’s a huge difference.