Minimum viable logging for SMB without a SOC

Building a pragmatic checklist for 200-seat orgs: EDR + DNS + email + cloud identity. What would you add or cut?