This page deals with SOC metrics: KPI and SLA, as part of the required reporting.
- Gartner, Cybersecurity business value benchmark
- LogRythm, 7 metrics to measure the effectiveness of your SOC
- SOC-CMM, Metrics
- MITRE SOC strategies paper
Generate metrics, leveraging the SIRP traceability and logging capabilities to get relevant data, as well as a bit of scripting.
As per Gartner, MTTR:
And MTTC:
Below are my recommendations for KPI and SLA. Unless specified, here are the recommended timeframes to compute those below KPI: 1 week, 1 month, and 6 months.
- Number of alerts (SIEM).
- Number of Dark Web related alerts.
- Number of verified alerts (ie.: confirmed security incidents).
- Percentage of verified alerts (ie.: confirmed security incidents);
- NB: that also gives the false-positive rate, at least at first glance. Some people may complainsaying that we need to remain cautious here, because there is also the false negative rate. But who knows how to actually measure/compute it, now and in time?
- I do recommend to conduct regular threat hunting activities, to help in measuring the false negative rate and confirm that known incidents were completely handled, but it seems that most organizations do not regularly run threat hunting operations, unfortunately :(
- Top security incident types.
- Top applications associated to alerts (ie.: detections).
- Most seen TTP in detection.
- Top 10 targeted users.
- Top 10 longest tickets before closure.
- Top detection rules triggering most false positives.
- List of detection rules triggering no detection.
- Top detection rules which corresponding alerts take the longest to be handled.
- Top 10 SIEM/XDR searches (ie: detection rules) triggering false positives.
- Top 10 SIEM/XDR errors (data indexing, search, scheduling, etc.).
- Number of sources/sensors' logs that are not yet integrated to the SIEM/XDR.
- Percentage of SIEM data that is not associated to SIEM searches (ie: detection rules).
- Percentage of coverage of detection matrix and/or MITRE ATT&CK.
- Number of security incidents that impacted PII;
- Number or security incidents that impacted business-critical data.
- Number of tickets in backlog (old tickets still not closed).
- Number of alerts that were handled with a validated playbook.
- Number of new automation playbooks that were created and successfully tested.
- Number of reporting automations that were created and successfully tested.
- Number of alerts that had to be handled by on-call analyst.
- List of security incidents for which containment phase failed or faced abnormal issues.
- Number of regulation violations caused by security incidents (eg.: GDPR, NIS2, DORA, HIPAA, SOC 2, etc.).
- Number of knowledge base articles that were created.
- Number of procedures that were updated/created.
- Number of detection use cases that were reviewed.
- Percentage of knowledge matrix completeness.
- Percentage of SOC analysts that successfully followed SOC-related training or passed required certifications.
- Percentage of SOC human resources turnover year over year.
- Top security incident types.
- Top applications associated to alerts (detections).
- Most seen TTP in incident response.
- Top incident types.
- Top 10 targeted users.
- Top 10 targeted endpoints.
- Top 10 longest tickets (ie.: incidents) before closure.
- Number of still ongoing incidents.
- Number of IOC that were generated during incident response.
- Number of incidents response requests that came down outside business hours.
- Percentage of incidents for which CSIRT feedback has been leveraged to help improve the SOC.
- Number of regulation violations caused by security incidents (eg.: GDPR, NIS2, DORA, HIPAA, SOC 2, etc.).
- Number of knowledge base articles that were created.
- Number of incident response playbooks that were created and successfuly tested.
- Percentage of CSIRT analysts that successfully followed SOC-related training or passed required certifications.
- Percentage of CSIRT human resources turnover year over year.
- Number of confirmed business-related security risks that have been taken in to account by the SOC for coverage.
- Percentage of known endpoints without company-required security solutions.
- Percentage of critical and high-risk applications that are not protected by multifactor authentication.
- Ratio of always-on personal privileged accounts to the number of individuals in roles who should have access to these accounts.
- Percentage of employees and contractors that have not completed mandatory security training.
- Percentage of employees who report suspicious emails for the standard organization-wide phishing campaigns.
- Percentage of click-throughs for the organization-wide phishing campaigns in the past 12 months.
- Number of endpoints having at least one vulnerability listed in CISA KEV list.
- Number of user accounts for which passwords are being considered as compromised (based on dark web monitoring).
- Number of public IP addresses (belonging to the organisation) that are black-listed or reported as malicious by third parties (eg.: on CTI portals like the ones listed on my threat intel page).
- Number of incidents that are likely to have an impact (ie.: non-compliance) on a ISO 27001 certification.
- SOC-CMM score for Technology.
- SOC-CMM score for Process.
- SOC-CMM score for People.
- SOC-CMM score for Business.
- SOC-CMM score for Services: Security Monitoring.
- SOC-CMM score for Services: Security Incident Management.
- SOC-CMM score for Services: Vulnerability Management.
- SOC-CMM score for Process: Use Case Management.
- SOC-CMM score for Process: Reporting & Communication.
- SOC-CMM score for Process: Operations & Facilities.
- SOC-CMM score for People.
- SOC-CMM score for Business: Customers and Stakeholders.
- SOC-CMM score for Business: Charter.
- SOC-CMM score for Business: Privacy & Policy.
- SOC-CMM score for Services: Security Incident Management.
- SOC-CMM score for Services: CTI.
- SOC-CMM score for Services: Forensics Analysis.
- SOC-CMM score for Services: Threat Hunting.
- Percentage and number of false positives (NB: 100% successfull detection is not achievable).
- Number of new detection use cases (SIEM rules) being put in production.
- Number of new detection automation use cases (enrichment, etc.) being put in production.
- Number of new response automation use cases (containment, eradication) being put in production.
- Number of detection rules which detection capability and handling process have been confirmed with purpleteaming session, so far.
- Percentage of EASM reports that were taken into account by the SOC to improve its perimeter coverage.
- MTTD (Mean Time To Detect): for all alerts, mean team in min/H to generate a detection based on detection logic and data/events.
- MTTH (Mean Time To Handle): for all incidents, mean time in H to handle (ie.: assign) the alerts to an analyst (NB: detection can be generated by security solutions themselves like EDR/NDR/ITDR, etc. or it can happen within a SIEM/XDR).
- MTTT (Mean Time To Triage): for all incidents, mean time in H to triage (ie.: "verify") the alerts.
- MTTC (Mean Time To Containment): for critical and medium security incidents, mean time in H to handle the alerts and start mitigation steps (from triage to initial response, mostly containment).
- MTTR (Mean Time To Recovery): for critical and medium security incidents, mean time in H to handle the alerts and remediate them (from triage to full remediation, including containment, malware eradication, and recovery).
- Percentage of missed SLA (if defined):
- MTTH;
- MTTT;
- MTTC;
- MTTR (NB: I recommend to be cautious with that one as some remediation plans for critical security incidents can take months or even years, far longer than expected at first).
- Number of missed calls (ie.: missed acceptable reply timeframe) to the on-call analyst.
- Number of purple-teaming sessions (SOC capabilities assessment) per year (at least 1).
- Percentage of critical assets that have successfully run ransomware recovery assessment, in the past 12 months.
- Average number of hours from the request for termination of access to sensitive or high-risk systems or information, to deprovisioning of all access.
- SOC-CMM score review (half-yearly or yearly)
Go to main page