building-soc-metrics-and-kpi-tracking

name	building-soc-metrics-and-kpi-tracking
description	Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.
domain	cybersecurity
tags	["soc","metrics","kpi","mttd","mttr","dashboard","reporting","continuous-improvement"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building Soc Metrics And Kpi Tracking

Overview

Cybersecurity skill for building soc metrics and kpi tracking. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "building soc metrics and kpi tracking"
• "SOC leadership needs data-driven visibility into operational performance"
• "Continuous improvement programs require baseline measurements and trend tracking"
• "Executive reporting demands quantified security posture and ROI metrics"

Use this skill when:

• SOC leadership needs data-driven visibility into operational performance
• Continuous improvement programs require baseline measurements and trend tracking
• Executive reporting demands quantified security posture and ROI metrics
• Staffing decisions need objective workload and capacity data
• Compliance audits require documented SOC performance evidence

Do not use metrics as punitive measures against analysts — metrics should drive process improvement, not individual performance management.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• SIEM with 90+ days of incident and alert disposition data
• Incident ticketing system (ServiceNow, Jira) with timestamp data for incident lifecycle
• Analyst shift schedules and staffing data
• ATT&CK Navigator for detection coverage tracking
• Dashboard platform (Splunk, Grafana, or Power BI)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}