Abstract

Security Operations Centres (SOCs) face four persistent challenges: fragmented visibility across tools, high false-positive alert volumes, slow incident response, and forensic logs that remain vulnerable to tampering. This paper presents a systematic literature review of 97 studies published between 2013 and 2026, examining how artificial intelligence (AI) and blockchain technologies have been applied to these problems individually and in combination. The review follows a PRISMA-style selection process and includes a study-quality assessment of the included works. Based on the gaps identified in the literature, we propose the Cyber Defence Security Operations Centre Management Platform (CDSOCMP), a conceptual four-phase architecture intended to integrate AI-based detection, real-time blockchain-anchored forensics, automated response orchestration, and unified multi-cloud monitoring. We emphasise that CDSOCMP is presented as a conceptual architecture derived from the synthesis of existing literature; it has not yet been implemented or empirically evaluated, and no performance figures for CDSOCMP itself are reported. The paper concludes with a discussion of how CDSOCMP relates to commercial SOC platforms, the threat of adversarial attacks on AI-driven defences, and a roadmap for prototype development and evaluation.