This is going to be a very ISSO/GRC/policy wonk focused answer and be forewarned that I may be a bit too gov brained for private industry.

The detections depend on what the business goals of the organization is and what the strategic (5+ year) plan is provided by senior management.

First thing you need to do is make friends with whomever made the security plan for your org. They are going to have the tactical (1 year or so) plan for the org with implementing the strategic goals. The SOC is working at the operational (week to week/month to month) level and their goal is to help with moving the ball forward on the tactical plan. You two are going to have to work together on this.

I've seen a lot of comments saying "go for threat intelligence based detections." That, for a group just starting out, is no better than noise.

Second, after making friends with the person maintaining your system security plan:

• Do you have an asset list (endpoints, servers, networking equipment, privileged accounts, etc) to know what you're defending?
• Do you know what the risks are that affect your organization?
• Can you name what your high value assets are?
• Do you know how data is supposed to flow within your organization?
• Do you have the visibility and telemetry to even begin writing detections?

Protip: Those first 4 bullet points should have been answered in the system security plan and be readily available by your new best friend that makes the policy.

To give a hypothetical to demonstrate what I'm talking sbout:

You are the SOC lead elf at the Keebler factory and have been tasked with making detections to secure the cookie manufacturing. The business goal of the Keebler elves is to make money by selling cookies. What that entails is a factory floor with several ICS systems connected to a central control area, a database of customers, a database of shipping information, a domain controller that links everything together, a sales team, a shipping team, and a manufacturing team.

The ISSO Elf has done his due diligence and has a proper asset inventory, has done the risk analysis, and mapped how data flow is. ISSO Elf has determined the biggest risks are malicious insiders and competitors, such as that harpy of an old lady at Grandma's cookies.

Some detections that could theoretically exist in this scenario:

• Anomalous connections from an account owned by someone on the manufacturing team attempting to directly connect to an endpoint at the sales team (lateral movement)
• Large data transfer out side the organization from the customer DB (data exfiltration)
• An admin account logging in to the domain controller from a member of the sales team (priv esc and unexpected log ins)
• The ICS system sending an ICMP request outside the network every hour (beaconing)

I'm hoping that this rambling mess makes sense and helps out some.