You need to consider the type of search you need in your SOC yourself.
Because I do not understand what your SOC is aiming for.
You can extract appropriate scenarios for your organization from Apps.
All of these scenarios are important.
I think that you should implement it from scenario where your organization can do first.
Splunk Security Essentials
https://splunkbase.splunk.com/app/3435/#/overview
Splunk Security Essentials for Fraud Detection
https://splunkbase.splunk.com/app/3693/#/overview
Splunk Security Essentials for Ransomware
https://splunkbase.splunk.com/app/3593/#/overview
There are Splunk guidelines.
https://www.splunk.com/pdfs/technical-briefs/building-a-soc-with-splunk-tech-brief.pdf
When you purchase ES you can consult with Splunk.
