/building-soc-metrics-and-kpi-tracking

name: building-soc-metrics-and-kpi-tracking
description: 'Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to
  Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership
  needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.

  '
domain: cybersecurity
subdomain: soc-operations
tags:
- soc
- metrics
- kpi
- mttd
- mttr
- dashboard
- reporting
- continuous-improvement
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- DE.CM-01
- DE.AE-02
- RS.MA-01
- DE.AE-06

Building SOC Metrics and KPI Tracking

When to Use

Use this skill when:

• SOC leadership needs data-driven visibility into operational performance
• Continuous improvement programs require baseline measurements and trend tracking
• Executive reporting demands quantified security posture and ROI metrics
• Staffing decisions need objective workload and capacity data
• Compliance audits require documented SOC performance evidence

**Do not use** metrics as punitive measures against analysts — metrics should drive process improvement, not individual performance management.

Prerequisites

• SIEM with 90+ days of incident and alert disposition data
• Incident ticketing system (ServiceNow, Jira) with timestamp data for incident lifecycle
• Analyst shift schedules and staffing data
• ATT&CK Navigator for detection coverage tracking
• Dashboard platform (Splunk, Grafana, or Power BI)

Workflow

Step 1: Define Core SOC Metrics Framework

Establish the key metrics aligned to NIST CSF functions:

| Metric | Definition | Target | NIST CSF | |--------|-----------|--------|----------| | MTTD | Time from threat occurrence to SOC detection | <15 min | Detect | | MTTA | Time from alert to analyst acknowledgment | <5 min | Respond | | MTTI | Time from acknowledgment to investigation start | <10 min | Respond | | MTTC | Time from investigation to containment | <1 hour | Respond | | MTTR | Time from detection to full resolution | <4 hours | Recover | | FP Rate | Percentage of false positive alerts | <30% | Detect | | TP Rate | Percentage of true positive alerts | >40% | Detect | | Coverage | ATT&CK techniques with active detection | >60% | Detect | | Dwell Time | Attacker time in network before detection | <24 hours | Detect | | Escalation Rate | % of Tier 1 alerts escalated to Tier 2/3 | 15-25% | Respond |

Step 2: Implement MTTD/MTTR Measurement

**Mean Time to Detect (MTTD):**

index=notable earliest=-30d status_label="Resolved*"
| eval mttd_seconds = _time - orig_time
| where mttd_seconds > 0 AND mttd_seconds < 86400  --- Exclude data quality issues
| stats avg(mttd_seconds) AS avg_mttd,
        median(mttd_seconds) AS med_mttd,
        perc90(mttd_seconds) AS p90_mttd,
        perc95(mttd_seconds) AS p95_mttd
  by urgency
| eval avg_mttd_min = round(avg_mttd / 60, 1)
| eval med_mttd_min = round(med_mttd / 60, 1)
| eval p90_mttd_min = round(p90_mttd / 60, 1)
| table urgency, avg_mttd_min, med_mttd_min, p90_mttd_min

**Mean Time to Respond (MTTR):**

index=notable earliest=-30d status_label="Resolved*"
| eval mttr_seconds = status_end - _time
| where mttr_seconds > 0 AND mttr_seconds < 604800  --- <7 days
| stats avg(mttr_seconds) AS avg_mttr,
        median(mttr_seconds) AS med_mttr,
        perc90(mttr_seconds) AS p90_mttr
  by urgency
| eval avg_mttr_hours = round(avg_mttr / 3600, 1)
| eval med_mttr_hours = round(med_mttr / 3600, 1)
| eval p90_mttr_hours = round(p90_mttr / 3600, 1)
| table urgency, avg_mttr_hours, med_mttr_hours, p90_mttr_hours

**MTTD/MTTR Trend Over Time:**

index=notable earliest=-90d status_label="Resolved*"
| eval mttd_min = (_time - orig_time) / 60
| eval mttr_hours = (status_end - _time) / 3600
| bin _time span=1w
| stats avg(mttd_min) AS avg_mttd_min, avg(mttr_hours) AS avg_mttr_hours,
        count AS incidents by _time
| table _time, incidents, avg_mttd_min, avg_mttr_hours

Step 3: Measure Alert Quality and Analyst Productivity

**Alert Disposition Analysis:**

index=notable earliest=-30d
| stats count AS total,
        sum(eval(if(status_label="Resolved - True Positive", 1, 0))) AS tp,
        sum(eval(if(status_label="Resolved - False Positive", 1, 0))) AS fp,
        sum(eval(if(status_label="Resolved - Benign", 1, 0))) AS benign,
        sum(eval(if(status_label="New" OR status_label="In Progress", 1, 0))) AS pending
| eval tp_rate = round(tp / total * 100, 1)
| eval fp_rate = round(fp / total * 100, 1)
| eval signal_noise = round(tp / (fp + 0.01), 2)
| table total, tp, fp, benign, pending, tp_rate, fp_rate, signal_noise

**Analyst Productivity Metrics:**

index=notable earliest=-30d status_label="Resolved*"
| stats count AS alerts_resolved,
        avg(eval((status_end - status_transition_time) / 60)) AS avg_triage_min,
        dc(rule_name) AS unique_rule_types
  by owner
| eval alerts_per_day = round(alerts_resolved / 30, 1)
| sort - alerts_resolved
| table owner, alerts_resolved, alerts_per_day, avg_triage_min, unique_rule_types

**Shift-Based Workload Distribution:**

index=notable earliest=-30d
| eval hour = strftime(_time, "%H")
| eval shift = case(
    hour >= 6 AND hour < 14, "Day (06-14)",
    hour >= 14 AND hour < 22, "Swing (14-22)",
    1=1, "Night (22-06)"
  )
| stats count AS alerts, dc(owner) AS analysts by shift
| eval alerts_per_analyst = round(alerts / analysts / 30, 1)
| table shift, alerts, analysts, alerts_per_analyst

Step 4: Track Detection Coverage

**ATT&CK Coverage Score:**

| inputlookup detection_rules_attack_mapping.csv
| stats dc(technique_id) AS covered_techniques by tactic
| join tactic type=left [
    | inputlookup attack_techniques_total.csv
    | stats dc(technique_id) AS