A SOC collects large amounts of logs but never assigns incident ownership or response procedures. What is missing from an effective security operations design?

1. Merely a larger dashboard font
2. An operational investigation and response process
3. Deleting all alerts to reduce workload
4. A guarantee that log collection prevents every attack