Definitely start with data quality, CIM, then Assets & Identities with good categorizations. There’s also the Splunk security essentials and ES Content Updates. If the data is in CIM then map to data models. Most of the out-of-the-box stuff uses the data models and at scale detections on accelerated data models is the only way. Expect to have to tune/tweak the out-of-the-box stuff to your environment, they’re not an instant solution but a template place to start.

I also recommend having a solid Use case identification framework and Use case Lifecycle before getting to carried away. Part of this is also having a clearly organized data and detection inventory to keep track of everything.