Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.
Do not use metrics as punitive measures against analysts — metrics should drive process improvement, not individual performance management.
Common Misconfigurations & Verification
Metric reads the wrong timestamp field: MTTD/MTTR depend on orig_time, _time, status_end, status_transition_time in index=notable. If your ES version doesn't populate status_end (or stores resolution in incident_review via | from datamodel), the search returns 0 or null and the scorecard shows a fake "GREEN". Validate each field is non-null on resolved notables before publishing.
Silent filtering skews the average: the guards where mttd_seconds > 0 AND < 86400 and < 604800 quietly drop long-dwell incidents — exactly the ones leadership cares about. A 30-day MTTR looks great because every breach over 7 days was excluded. Report the count dropped alongside the average, or the KPI lies by omission.
Coverage lookup mismatch: ATT&CK coverage joins detection_rules_attack_mapping.csv to attack_techniques_total.csv on tactic; a sub-technique vs technique ID mismatch (T1003 vs T1003.001) or stale total-technique list inflates coverage_pct past 100% or undercounts. Verify the join key format matches on both sides.
Disposition strings don't match:status_label="Resolved - True Positive" is an exact-string match; if analysts close as "True Positive" or "Resolved-TP", TP/FP rates undercount and signal-to-noise is wrong. Normalize disposition values via a lookup.
Verification: hand-calculate MTTD/MTTR for 3-5 known incidents and reconcile against the dashboard; confirm tstats data-source coverage reflects sourcetypes actually ingesting (not just defined in ) before reporting a posture score.
expected_data_sources.csv
Prerequisites
SIEM with 90+ days of incident and alert disposition data
Incident ticketing system (ServiceNow, Jira) with timestamp data for incident lifecycle
Analyst shift schedules and staffing data
ATT&CK Navigator for detection coverage tracking
Dashboard platform (Splunk, Grafana, or Power BI)
Workflow
Step 1: Define Core SOC Metrics Framework
Establish the key metrics aligned to NIST CSF functions:
Metric
Definition
Target
NIST CSF
MTTD
Time from threat occurrence to SOC detection
<15 min
Detect
MTTA
Time from alert to analyst acknowledgment
<5 min
Respond
MTTI
Time from acknowledgment to investigation start
<10 min
Respond
MTTC
Time from investigation to containment
<1 hour
Respond
MTTR
Time from detection to full resolution
<4 hours
Recover
FP Rate
Percentage of false positive alerts
<30%
Detect
TP Rate
Percentage of true positive alerts
>40%
Detect
Coverage
ATT&CK techniques with active detection
>60%
Detect
Dwell Time
Attacker time in network before detection
<24 hours
Detect
Escalation Rate
% of Tier 1 alerts escalated to Tier 2/3
15-25%
Respond
Step 2: Implement MTTD/MTTR Measurement
Mean Time to Detect (MTTD):
index=notable earliest=-30d status_label="Resolved*"
| eval mttd_seconds = _time - orig_time
| where mttd_seconds > 0 AND mttd_seconds < 86400 --- Exclude data quality issues
| stats avg(mttd_seconds) AS avg_mttd,
median(mttd_seconds) AS med_mttd,
perc90(mttd_seconds) AS p90_mttd,
perc95(mttd_seconds) AS p95_mttd
by urgency
| eval avg_mttd_min = round(avg_mttd / 60, 1)
| eval med_mttd_min = round(med_mttd / 60, 1)
| eval p90_mttd_min = round(p90_mttd / 60, 1)
| table urgency, avg_mttd_min, med_mttd_min, p90_mttd_min
Mean Time to Respond (MTTR):
index=notable earliest=-30d status_label="Resolved*"
| eval mttr_seconds = status_end - _time
| where mttr_seconds > 0 AND mttr_seconds < 604800 --- <7 days
| stats avg(mttr_seconds) AS avg_mttr,
median(mttr_seconds) AS med_mttr,
perc90(mttr_seconds) AS p90_mttr
by urgency
| eval avg_mttr_hours = round(avg_mttr / 3600, 1)
| eval med_mttr_hours = round(med_mttr / 3600, 1)
| eval p90_mttr_hours = round(p90_mttr / 3600, 1)
| table urgency, avg_mttr_hours, med_mttr_hours, p90_mttr_hours
MTTD/MTTR Trend Over Time:
index=notable earliest=-90d status_label="Resolved*"
| eval mttd_min = (_time - orig_time) / 60
| eval mttr_hours = (status_end - _time) / 3600
| bin _time span=1w
| stats avg(mttd_min) AS avg_mttd_min, avg(mttr_hours) AS avg_mttr_hours,
count AS incidents by _time
| table _time, incidents, avg_mttd_min, avg_mttr_hours
Step 3: Measure Alert Quality and Analyst Productivity
Alert Disposition Analysis:
index=notable earliest=-30d
| stats count AS total,
sum(eval(if(status_label="Resolved - True Positive", 1, 0))) AS tp,
sum(eval(if(status_label="Resolved - False Positive", 1, 0))) AS fp,
sum(eval(if(status_label="Resolved - Benign", 1, 0))) AS benign,
sum(eval(if(status_label="New" OR status_label="In Progress", 1, 0))) AS pending
| eval tp_rate = round(tp / total * 100, 1)
| eval fp_rate = round(fp / total * 100, 1)
| eval signal_noise = round(tp / (fp + 0.01), 2)
| table total, tp, fp, benign, pending, tp_rate, fp_rate, signal_noise
Analyst Productivity Metrics:
index=notable earliest=-30d status_label="Resolved*"
| stats count AS alerts_resolved,
avg(eval((status_end - status_transition_time) / 60)) AS avg_triage_min,
dc(rule_name) AS unique_rule_types
by owner
| eval alerts_per_day = round(alerts_resolved / 30, 1)
| sort - alerts_resolved
| table owner, alerts_resolved, alerts_per_day, avg_triage_min, unique_rule_types
