Not with buying a SIEM. A sequence of steps that gives you visibility into your infrastructure in the first weeks, not a year from now.
A typical mistake is to start a monitoring center by buying a platform. Licenses eat the budget, event sources take years to onboard, and visibility never arrives. Start with an inventory: which systems are critical to the business and what happens if they stop.
The second step is logging. Before you can analyze anything, events need to be collected and stored: domain controllers, remote access tools, firewalls, the email gateway, endpoints. Even without a SIEM, centralized log collection already makes incident investigation possible.
The third step is detection rules tailored to your own threat model, not a thousand out-of-the-box rules. Ten working rules with a low false positive rate are more useful than a hundred ignored alerts.
Only then come duty shifts, playbooks and SLAs. Without people who are obliged to respond within a set time, a SOC remains a set of tools rather than a security function.