SOC Operations
Intermediate 16 min read SOC Operations
SOC Metrics and Reporting
The numbers that run a SOC: MTTA/MTTR, false-positive rate, coverage, and the honest dashboards that turn activity into decisions.
MTTAMTTRfalse positive ratecoverageSLAdashboardreporting
Introduction
What is this?
SOC metrics turn alert-handling activity into reviewable signals: speed of triage, accuracy of verdicts, coverage of defenses, and the cost of the queue.
Motivation
Why do you need it?
- Leadership budgets and trusts what trends; an unmeasured SOC is a story, not a system.
- Choosing the right metric (not vanity ones) is itself a security decision.
- Metrics catch decay before an incident: rising MTTA is a warning light, not an afterthought.
Think about it
Mental model
Imagine
A cockpit dial
Think of
A dial that only shows how often you look at it
The useful gauge is actionable; the vanity gauge is a pet.
Mechanics
How it works
- MTTA: minutes from alert to acknowledgment; MTTR mirrors to resolution.
- False-positive rate per rule and queue-wide; accuracy of verdicts measured by missed TP audits.
- Coverage: detections per prioritized ATT&CK tactic vs the estate's risk surface.
- Tie metrics to SLAs with owners; trends are reviewed weekly, anomalies immediately.
From events to decisions via metrics
Eventsalerts and responses
MeasureMTTA/MTTR/FP-rate/coverage
Trendweekly deltas, anomaly spikes
Acttuning, staffing, playbook edits
Reporta dashboard leadership reads
Real world
In production
- A weekly SOC review sees MTTA climb 40% and re-prioritizes queue staffing within a day.
- An org reports 'true-positive rate' monthly and uses the spikes to justify rule tuning time.
- A dashboard shows coverage per tactic; the red 'Execution' cell funds the next detection project.
Guidelines
Best practices
- Measure the queue, not the personality: MTTA, FP-rate, coverage, and SLA breaches.
- Separate leading (coverage, readiness) from lagging (claim, cost) metrics in the report.
- Review metrics weekly with owners; an anomaly in 15 minutes beats a pattern after a quarter.
- Report honestly: a rising FP-rate is a finding, not a failure of the reporter.
Watch out
Common mistakes
- Gaming MTTA by acknowledging instantly and never resolving — the metric lies.
- Reporting only 'incidents avoided' which nobody can quantify.
- Measuring analysts, not the process; the queue gets quiet when nobody reads it.
- A dashboard nobody opens: 'the report is done' is not 'the report is read'.
When things break
Debugging tips
- When a metric gaps, rebuild it from raw data by hand once — the tooling sometimes forks definitions.
- Compare MTTA across shifts; a shift gap is a staffing/tooling story, not a math error.
- Track FP-rate per rule for a month and retire the loudest rule with real evidence.
Security
Security considerations
- Metrics themselves contain operational sensitivity; share trends internally, never full queues broadly.
- SLA-linked metrics drive priority — protect the measurement from gaming with a periodic audit.
Interviews
Interview checkpoint
Test yourself
Quick quiz
0/2
1
MTTR improvements are best accompanied by...
2
A vanity metric is one that...
Go deeper