Security Operations Centers operate in an increasingly complex landscape characterized by high volumes of heterogeneous security events, evolving attack techniques and stringent requirements for timely and accurate incident response. In this context, the initial phases of incident handling, particularly detection triage and early response, are often affected by fragmentation, manual effort and variability in analyst decision-making, which can reduce both efficiency and consistency across operations. This thesis proposes a structured and reproducible approach to address these challenges by integrating detection engineering, automated orchestration and AI-assisted decision support into a unified operational pipeline. The work is based on the definition of portable detection logic using Sigma rules, subsequently translated into platform-specific queries for SGBox and Splunk in order to enable alert generation in heterogeneous SIEM environments.