SOC Metrics and Reporting — Measuring What Matters

Metrics exist to make improvement visible and to focus resources on real problems. Wrong metrics — optimized for convenience rather than security outcomes — create perverse incentives that make the SOC look good on paper while getting worse at its job.

The Metric Hierarchy

Strategic (CISO / board view):
  Security posture → detection coverage gap, breach rate, incident severity trend

Operational (SOC manager view):
  Efficiency → MTTD, MTTR, SLA compliance, alert volume trends

Tactical (analyst view):
  Quality → investigation completeness, ATT&CK tagging accuracy, escalation quality

Each layer serves a different decision-maker. The strategic view tells the board whether to invest more; the operational view tells the manager where to focus; the tactical view tells the analyst what to improve.

Core Operational Metrics

MTTD (Mean Time to Detect)

MTTD = Time of first SOC alert - Time of earliest attacker action in logs

Example:
  Earliest attacker action: phishing delivered 09:14:22
  First SOC alert: 10:07:15
  MTTD = 52 minutes 53 seconds

Target MTTD by priority:
  P1: < 5 minutes (real-time alerting on active breach indicators)
  P2: < 15 minutes
  P3: < 60 minutes
  P4: < 24 hours

MTTD depends on detection rule quality, not analyst speed. If the rule doesn’t fire for 45 minutes, MTTD is 45 minutes regardless of how fast analysts work.

MTTR (Mean Time to Respond)

MTTR = Time of containment complete - Time of first SOC alert

Components of MTTR:
  Triage time: first alert → classification (analyst-controlled)
  Investigation time: classification → confirmed scope (analyst-controlled)
  Escalation time: if escalated, handoff + L2 response (process-controlled)
  Containment time: containment actions completed (access + approvals)

Target MTTR by priority:
  P1: < 30 minutes
  P2: < 2 hours
  P3: < 8 hours

TP/FP Ratios by Alert Source

Alert source          Week N    TP%   FP%   Notes
SURICATA_CS_JA3       47       62%   38%   Acceptable — high-value TP when fires
SURICATA_EICAR        203       0%  100%   Candidate for auto-close rule
ENTRA_IMPOSSIBLE_TRVL 31       42%   58%   High FP from VPN mismatch — needs filter
SYSMON_POWERSHELL_ENC 87       31%   69%   Reduce false positives via CommandLine allowlist

Rules with > 90% FP rate and no TP in 90 days: candidates for retirement or significant tuning.

Detection Coverage Gap

Process:

Define threat profile: which ATT&CK techniques are relevant to your org?
- Pull from MITRE ATT&CK Navigator for your industry group
- Add techniques observed in incidents over the past year
- Add techniques from threat intel reports for your threat actors
Map existing detection rules to ATT&CK IDs:
- Each rule should have an ATT&CK tag (this is why tagging matters)
- Rules with no tag can’t contribute to coverage measurement
Calculate gap:
- Techniques in threat profile: 85
- Techniques with at least one mapped rule: 51
- Coverage: 60%
- Gap techniques: 34 (drive detection engineering backlog)

Reporting the gap (executive version):

"We have detection coverage for 60% of the attack techniques used by the threat
actors most likely to target our organization. We have identified 34 technique
gaps — the detection engineering backlog will reduce this to 35% gap by Q4."

Weekly SOC Report Template

SECURITY OPERATIONS WEEKLY REPORT — WEEK OF [DATE]

ALERT SUMMARY
  Total alerts: 1,847 (↑12% vs. prior week)
  True positives: 23 (1.2%)
  False positives: 1,798 (97.3%)
  Under investigation: 26 (1.4%)

PERFORMANCE VS. SLA
  P1 MTTD: 4.2 min avg (SLA: <5 min) ✓
  P2 MTTD: 18.1 min avg (SLA: <15 min) ✗  ← below target
  P1 MTTR: 28 min avg (SLA: <30 min) ✓
  P2 MTTR: 1h 44min avg (SLA: <2h) ✓

NOTABLE INCIDENTS
  IR-2024-0892: AiTM phishing — finance user compromised, BEC attempt blocked.
                Status: Contained. Lessons-learned scheduled [date].
  IR-2024-0893: Cobalt Strike beacon — isolated workstation, no lateral movement.
                Status: Eradication complete.

TOP FP RULES (tuning candidates)
  ENTRA_IMPOSSIBLE_TRAVEL: 89 FP in 7 days — VPN exit nodes causing false positives.
  Action: Filter for known VPN exit IP ranges. Owner: detect-eng. Deadline: 5 days.

ACTION ITEM STATUS (from lessons-learned)
  DE-2024-187: MailItemsAccessed rule — In progress (50% complete)
  EM-2024-022: DMARC p=reject — Blocked on mail team scheduling. Escalated to CISO.

Retrieval Practice

The CISO asks: 'Our TP rate is only 2%. That seems low — are we wasting time on too many alerts?' How do you explain the TP rate, and what is a better question to ask?

Reveal answer

A 2% TP rate in a mature SOC is not unusual — alert rules are tuned to be sensitive (catch real threats), which means they fire on many benign events too. The TP rate reflects rule tuning, not SOC quality. The better questions: (1) 'What is our MTTD for the TPs we find — are we catching real incidents fast enough?' (2) 'What is our detection coverage gap — are we missing attack techniques entirely?' (3) 'Are the FP alerts providing enrichment value, or are they pure noise?' A SOC with 1% TP rate but 4-minute MTTD on P1 incidents and 80% ATT&CK coverage is better than a SOC with 10% TP rate but 2-hour MTTD and 40% coverage. TP rate is a tuning health metric, not a performance metric.

Retrieval Practice

Detection engineering asks for the top 5 techniques to prioritize for new rules based on last year's incidents. How would you produce this list from SOC data?

Reveal answer

Process: (1) Export all confirmed TP dispositions from the past 12 months. (2) Extract ATT&CK technique IDs from the disposition tags. (3) Count: how many incidents involved each technique? (4) Cross-reference with the detection coverage gap — for each technique that appeared in incidents, did a rule fire on it, or was it discovered through manual forensics? (5) Priority = high-frequency techniques that were discovered late (MTTD > SLA) OR discovered manually (no alert) — these are the gaps that let attackers dwell. Techniques found quickly and automatically are already well-covered. Output: a ranked list of technique IDs with incident count, average MTTD, and whether current coverage is via active alert vs. retroactive forensics.