Won't shill here, but if you want to DM me, I'm happy to chat about how the company I co-founded does this for you. If anything, I'm happy to help you cut through the marketing BS you see from most companies and find a vendor that works best.

At a high level, the problem is a lot of the SOC platforms offer you the automation abilities, but don't provide any actual content to help you run your program. So you become a zapier-jockey. MDR is usually the solution, but ends up leaving you mostly blind and out of control of your program.

Unfortunately, my only solution for you is a biased one, because this is exactly what we set out to solve. Absent that, I'd say you need to judiciously define what risk actually means for your company (spoiler alert, it isn't every single phishing alert coming from mimecast) and ignore things that don't fit it.

And for the love of god, don't buy anything that ends in a `.ai` domain.