The first instinct when a team decides to take detection seriously is to buy something. That instinct is usually wrong, and it is expensive to be wrong about.
You already generate more security-relevant data than you are reading. The question is not what to collect. It is what to look at, in what order, and what to do when it says something.
Work through what exists. Your identity provider or domain controller logs every authentication, successful and failed, with a source address and a time. Your firewall records sessions. Your VPN concentrator knows who connected from where and for how long. Your mail gateway sees every message that was rejected and why. Your DNS resolver sees every name every machine asked for. Your DHCP server is the only thing that can later tell you which physical device an address belonged to at a given hour.
That list costs nothing. It is already being written, usually to a disk that rotates it away in a fortnight.
The order to tackle it in is not the order of volume, it is the order of usefulness. Authentication first: it is the smallest of the sources and it catches the largest class of intrusion, because someone logging in is how most of them start. DNS second, because malware has to resolve something, and a workstation asking for a domain registered eleven days ago at three in the morning is a sentence you can act on. Outbound flows third, because exfiltration is the one behaviour an attacker cannot avoid.
Two engineering decisions matter more than any product choice.
Put the logs somewhere the origin host cannot edit. An attacker with administrator rights on a server will clear its logs, and a log that only exists on the machine being attacked is not evidence. Forward it, even if the destination is just another box with a disk.
Then fix the clocks. Run NTP everywhere and agree one timezone — UTC, and write it in the log. Correlating three sources with three different offsets during an incident, at two in the morning, is where investigations go to die.