Threat Centric or Alert Centric: What's the Best Strategy for SOAR in the SOC?