ENISA published a very practical guide about establishing a Computer Security Incident Response Team (CSIRT) or Security Operations Centre (SOC).

Download the guide here: https://www.enisa.europa.eu/publications/how-to-set-up-csirt-and-soc