I have been working in a ASOC for ha past 3 yrs my main focus is on detection development, UseCase scenarios, figuring out how to catch/stop adversaires. Be aware I also work night shifts ATM so I may not be able reply to your inquiry for a few days. I also have SANS GCDA.