SOC monitoring - Technical Guidance

Are there any resources, technical guidance or best practices about building a SOC for a small-medium company?
I'm NOT interested about the structure, the teams, policies and procedures. Although they are super important, let's assume they 're already in place.
I'm looking for something more technical.For example:


* Agents on endpoints must send logs to a SIEM. Directly to SIEM or to a forwarder node, depending on the network structure?

* All firewall logs should be monitored.

* Network traffic …

agents best practices building cybersecurity endpoints guidance important logs medium monitoring policies policies and procedures practices procedures resources send soc structure super teams technical