How are SOC analysts using LLMs today?

For those working in SOCs: how (if at all) are you using LLMs in day-to-day workflows like alert triage, investigations, scripting, reporting, or playbooks?

What’s been genuinely useful so far, and what feels like hype or not worth the effort?

I’m particularly interested in real-world experiences rather than vendor pitches.

Note: I’m doing academic / non-commercial research in this area. If you’re open to sharing more detail privately, feel free to DM me — I’m not posting a survey link here due to sub rules.