[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADZYR7P2PQQCP75TA5TWPG":3,"skill-same:01M6ADZYR7P2PQQCP75TA5TWPG":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6ADZYR7P2PQQCP75TA5TWPG","building-soc-metrics-and-kpi-tracking",null,"Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-metrics-and-kpi-tracking\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"metrics","soc","building soc metrics and kpi tracking","security","performance","cybersecurity","security operations","siem","dashboard","reporting","productivity","data","kpi","mttd","mttr","continuous-improvement","2026-11-10 10:12:30",false,"---\nname: building-soc-metrics-and-kpi-tracking\ndescription: 'Builds SOC performance metrics and KPI tracking dashboards measuring\n  Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst\n  productivity, and detection coverage using SIEM data. Use when SOC leadership needs\n  operational visibility, continuous improvement tracking, or executive-level reporting\n  on security operations effectiveness.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- metrics\n- kpi\n- mttd\n- mttr\n- dashboard\n- reporting\n- continuous-improvement\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1071\n---\n# Building SOC Metrics and KPI Tracking\n\n## When to Use\n\nUse this skill when:\n- SOC leadership needs data-driven visibility into operational performance\n- Continuous improvement programs require baseline measurements and trend tracking\n- Executive reporting demands quantified security posture and ROI metrics\n- Staffing decisions need objective workload and capacity data\n- Compliance audits require documented SOC performance evidence\n\n**Do not use** metrics as punitive measures against analysts — metrics should drive process improvement, not individual performance management.\n\n## Prerequisites\n\n- SIEM with 90+ days of incident and alert disposition data\n- Incident ticketing system (ServiceNow, Jira) with timestamp data for incident lifecycle\n- Analyst shift schedules and staffing data\n- ATT&CK Navigator for detection coverage tracking\n- Dashboard platform (Splunk, Grafana, or Power BI)\n\n## Workflow\n\n### Step 1: Define Core SOC Metrics Framework\n\nEstablish the key metrics aligned to NIST CSF functions:\n\n| Metric | Definition | Target | NIST CSF |\n|--------|-----------|--------|----------|\n| MTTD | Time from threat occurrence to SOC detection | \u003C15 min | Detect |\n| MTTA | Time from alert to analyst acknowledgment | \u003C5 min | Respond |\n| MTTI | Time from acknowledgment to investigation start | \u003C10 min | Respond |\n| MTTC | Time from investigation to containment | \u003C1 hour | Respond |\n| MTTR | Time from detection to full resolution | \u003C4 hours | Recover |\n| FP Rate | Percentage of false positive alerts | \u003C30% | Detect |\n| TP Rate | Percentage of true positive alerts | >40% | Detect |\n| Coverage | ATT&CK techniques with active detection | >60% | Detect |\n| Dwell Time | Attacker time in network before detection | \u003C24 hours | Detect |\n| Escalation Rate | % of Tier 1 alerts escalated to Tier 2\u002F3 | 15-25% | Respond |\n\n### Step 2: Implement MTTD\u002FMTTR Measurement\n\n**Mean Time to Detect (MTTD):**\n```spl\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttd_seconds = _time - orig_time\n| where mttd_seconds > 0 AND mttd_seconds \u003C 86400  --- Exclude data quality issues\n| stats avg(mttd_seconds) AS avg_mttd,\n        median(mttd_seconds) AS med_mttd,\n        perc90(mttd_seconds) AS p90_mttd,\n        perc95(mttd_seconds) AS p95_mttd\n  by urgency\n| eval avg_mttd_min = round(avg_mttd \u002F 60, 1)\n| eval med_mttd_min = round(med_mttd \u002F 60, 1)\n| eval p90_mttd_min = round(p90_mttd \u002F 60, 1)\n| table urgency, avg_mttd_min, med_mttd_min, p90_mttd_min\n```\n\n**Mean Time to Respond (MTTR):**\n```spl\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttr_seconds = status_end - _time\n| where mttr_seconds > 0 AND mttr_seconds \u003C 604800  --- \u003C7 days\n| stats avg(mttr_seconds) AS avg_mttr,\n        median(mttr_seconds) AS med_mttr,\n        perc90(mttr_seconds) AS p90_mttr\n  by urgency\n| eval avg_mttr_hours = round(avg_mttr \u002F 3600, 1)\n| eval med_mttr_hours = round(med_mttr \u002F 3600, 1)\n| eval p90_mttr_hours = round(p90_mttr \u002F 3600, 1)\n| table urgency, avg_mttr_hours, med_mttr_hours, p90_mttr_hours\n```\n\n**MTTD\u002FMTTR Trend Over Time:**\n```spl\nindex=notable earliest=-90d status_label=\"Resolved*\"\n| eval mttd_min = (_time - orig_time) \u002F 60\n| eval mttr_hours = (status_end - _time) \u002F 3600\n| bin _time span=1w\n| stats avg(mttd_min) AS avg_mttd_min, avg(mttr_hours) AS avg_mttr_hours,\n        count AS incidents by _time\n| table _time, incidents, avg_mttd_min, avg_mttr_hours\n```\n\n### Step 3: Measure Alert Quality and Analyst Productivity\n\n**Alert Disposition Analysis:**\n```spl\nindex=notable earliest=-30d\n| stats count AS total,\n        sum(eval(if(status_label=\"Resolved - True Positive\", 1, 0))) AS tp,\n        sum(eval(if(status_label=\"Resolved - False Positive\", 1, 0))) AS fp,\n        sum(eval(if(status_label=\"Resolved - Benign\", 1, 0))) AS benign,\n        sum(eval(if(status_label=\"New\" OR status_label=\"In Progress\", 1, 0))) AS pending\n| eval tp_rate = round(tp \u002F total * 100, 1)\n| eval fp_rate = round(fp \u002F total * 100, 1)\n| eval signal_noise = round(tp \u002F (fp + 0.01), 2)\n| table total, tp, fp, benign, pending, tp_rate, fp_rate, signal_noise\n```\n\n**Analyst Productivity Metrics:**\n```spl\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| stats count AS alerts_resolved,\n        avg(eval((status_end - status_transition_time) \u002F 60)) AS avg_triage_min,\n        dc(rule_name) AS unique_rule_types\n  by owner\n| eval alerts_per_day = round(alerts_resolved \u002F 30, 1)\n| sort - alerts_resolved\n| table owner, alerts_resolved, alerts_per_day, avg_triage_min, unique_rule_types\n```\n\n**Shift-Based Workload Distribution:**\n```spl\nindex=notable earliest=-30d\n| eval hour = strftime(_time, \"%H\")\n| eval shift = case(\n    hour >= 6 AND hour \u003C 14, \"Day (06-14)\",\n    hour >= 14 AND hour \u003C 22, \"Swing (14-22)\",\n    1=1, \"Night (22-06)\"\n  )\n| stats count AS alerts, dc(owner) AS analysts by shift\n| eval alerts_per_analyst = round(alerts \u002F analysts \u002F 30, 1)\n| table shift, alerts, analysts, alerts_per_analyst\n```\n\n### Step 4: Track Detection Coverage\n\n**ATT&CK Coverage Score:**\n```spl\n| inputlookup detection_rules_attack_mapping.csv\n| stats dc(technique_id) AS covered_techniques by tactic\n| join tactic type=left [\n    | inputlookup attack_techniques_total.csv\n    | stats dc(technique_id) AS total_techniques by tactic\n  ]\n| eval coverage_pct = round(covered_techniques \u002F total_techniques * 100, 1)\n| sort tactic\n| table tactic, covered_techniques, total_techniques, coverage_pct\n```\n\n**Data Source Coverage:**\n```spl\n| inputlookup expected_data_sources.csv\n| join data_source type=left [\n    | tstats count where index=* by sourcetype\n    | rename sourcetype AS data_source\n    | eval status = \"Active\"\n  ]\n| eval source_status = if(isnotnull(status), \"Collecting\", \"MISSING\")\n| stats count by source_status\n| table source_status, count\n```\n\n### Step 5: Build Executive Reporting Dashboard\n\n**Monthly SOC Executive Summary:**\n```spl\n--- Incident summary by category\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| stats count by urgency\n| eval order = case(urgency=\"critical\", 1, urgency=\"high\", 2, urgency=\"medium\", 3,\n                    urgency=\"low\", 4, urgency=\"informational\", 5)\n| sort order\n\n--- Month-over-month comparison\nindex=notable earliest=-60d\n| eval period = if(_time > relative_time(now(), \"-30d\"), \"This Month\", \"Last Month\")\n| stats count by period, urgency\n| chart sum(count) AS incidents by urgency, period\n\n--- Top 5 incident categories\nindex=notable earliest=-30d status_label=\"Resolved - True Positive\"\n| top rule_name limit=5\n| table rule_name, count, percent\n```\n\n**Security Posture Scorecard:**\n```spl\n| makeresults\n| eval metrics = mvappend(\n    \"MTTD: 8.3 min (Target: \u003C15 min) | STATUS: GREEN\",\n    \"MTTR: 3.2 hours (Target: \u003C4 hours) | STATUS: GREEN\",\n    \"FP Rate: 27% (Target: \u003C30%) | STATUS: GREEN\",\n    \"Detection Coverage: 64% (Target: >60%) | STATUS: GREEN\",\n    \"Analyst Utilization: 78% (Target: 60-80%) | STATUS: GREEN\",\n    \"Incident Backlog: 12 (Target: \u003C20) | STATUS: GREEN\"\n  )\n| mvexpand metrics\n| table metrics\n```\n\n### Step 6: Implement Continuous Improvement Tracking\n\nTrack improvement initiatives and their impact:\n\n```spl\n--- Improvement initiative tracking\n| inputlookup soc_improvement_initiatives.csv\n| eval status_color = case(\n    status=\"Completed\", \"green\",\n    status=\"In Progress\", \"yellow\",\n    status=\"Planned\", \"gray\"\n  )\n| table initiative, start_date, target_date, status, metric_impact, baseline, current\n```\n\nExample initiatives:\n```csv\ninitiative,start_date,target_date,status,metric_impact,baseline,current\nRisk-Based Alerting,2024-01-15,2024-03-15,Completed,Alert Volume,-84%,287\u002Fday\nSigma Rule Library,2024-02-01,2024-04-01,In Progress,ATT&CK Coverage,61%,64%\nSOAR Phishing Playbook,2024-02-15,2024-03-30,In Progress,Phishing MTTR,45min,18min\nAnalyst Training Program,2024-01-01,2024-06-30,In Progress,TP Rate,31%,41%\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MTTD** | Mean Time to Detect — average time from threat occurrence to SOC alert generation |\n| **MTTR** | Mean Time to Respond — average time from detection to incident resolution |\n| **MTTA** | Mean Time to Acknowledge — average time from alert generation to analyst assignment |\n| **Signal-to-Noise Ratio** | Ratio of true positive alerts to total alerts — higher is better |\n| **Dwell Time** | Duration an attacker remains undetected in the environment — key indicator of detection effectiveness |\n| **Analyst Utilization** | Percentage of analyst time spent on productive investigation vs. overhead tasks |\n\n## Tools & Systems\n\n- **Splunk Dashboard Studio**: Advanced visualization framework for building interactive SOC metric dashboards\n- **Grafana**: Open-source analytics and visualization platform supporting multiple data sources\n- **Power BI**: Microsoft business intelligence tool for executive-level reporting and trend analysis\n- **ATT&CK Navigator**: MITRE tool for visualizing detection coverage as layered heatmaps\n- **ServiceNow Performance Analytics**: ITSM analytics module for tracking incident lifecycle metrics\n\n## Common Scenarios\n\n- **Quarterly Business Review**: Present MTTD\u002FMTTR trends, detection coverage growth, and alert quality improvements\n- **Staffing Justification**: Use workload metrics to justify additional analyst headcount or shift adjustments\n- **Tool ROI Assessment**: Compare alert quality and response times before and after new tool deployment\n- **Compliance Evidence**: Provide documented SOC performance metrics for ISO 27001 or SOC 2 audits\n- **Vendor Comparison**: Benchmark SOC metrics against industry peers using surveys (SANS, Ponemon)\n\n## Output Format\n\n```\nSOC PERFORMANCE REPORT — March 2024\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nKEY METRICS:\n  Metric              Current    Target     Trend    Status\n  MTTD                8.3 min    \u003C15 min    -12%     GREEN\n  MTTR                3.2 hrs    \u003C4 hrs     -18%     GREEN\n  FP Rate             27%        \u003C30%       -5%      GREEN\n  TP Rate             41%        >40%       +3%      GREEN\n  ATT&CK Coverage     64%        >60%       +3%      GREEN\n  Alerts\u002FAnalyst\u002FDay  24         \u003C50        -84%     GREEN\n\nINCIDENT SUMMARY:\n  Total Incidents:     147 (Critical: 3, High: 23, Medium: 78, Low: 43)\n  Avg Resolution:      3.2 hours (Critical: 1.8h, High: 2.9h, Medium: 4.1h)\n  SLA Compliance:      94% (Target: >90%)\n\nIMPROVEMENT HIGHLIGHTS:\n  [1] RBA deployment reduced daily alerts from 1,847 to 287 (-84%)\n  [2] New Sigma rules added 12 ATT&CK techniques to coverage\n  [3] SOAR phishing playbook reduced phishing MTTR by 60%\n\nAREAS FOR IMPROVEMENT:\n  [1] Lateral movement detection coverage at 58% (below 60% target)\n  [2] Night shift MTTD 23% slower than day shift\n  [3] 4 critical vulnerability scan tickets overdue on SLA\n```\n","# Building SOC Metrics and KPI Tracking\n\n## When to Use\n\nUse this skill when:\n- SOC leadership needs data-driven visibility into operational performance\n- Continuous improvement programs require baseline measurements and trend tracking\n- Executive reporting demands quantified security posture and ROI metrics\n- Staffing decisions need objective workload and capacity data\n- Compliance audits require documented SOC performance evidence\n\n**Do not use** metrics as punitive measures against analysts — metrics should drive process improvement, not individual performance management.\n\n## Prerequisites\n\n- SIEM with 90+ days of incident and alert disposition data\n- Incident ticketing system (ServiceNow, Jira) with timestamp data for incident lifecycle\n- Analyst shift schedules and staffing data\n- ATT&CK Navigator for detection coverage tracking\n- Dashboard platform (Splunk, Grafana, or Power BI)\n\n## Workflow\n\n### Step 1: Define Core SOC Metrics Framework\n\nEstablish the key metrics aligned to NIST CSF functions:\n\n| Metric | Definition | Target | NIST CSF |\n|--------|-----------|--------|----------|\n| MTTD | Time from threat occurrence to SOC detection | \u003C15 min | Detect |\n| MTTA | Time from alert to analyst acknowledgment | \u003C5 min | Respond |\n| MTTI | Time from acknowledgment to investigation start | \u003C10 min | Respond |\n| MTTC | Time from investigation to containment | \u003C1 hour | Respond |\n| MTTR | Time from detection to full resolution | \u003C4 hours | Recover |\n| FP Rate | Percentage of false positive alerts | \u003C30% | Detect |\n| TP Rate | Percentage of true positive alerts | >40% | Detect |\n| Coverage | ATT&CK techniques with active detection | >60% | Detect |\n| Dwell Time | Attacker time in network before detection | \u003C24 hours | Detect |\n| Escalation Rate | % of Tier 1 alerts escalated to Tier 2\u002F3 | 15-25% | Respond |\n\n### Step 2: Implement MTTD\u002FMTTR Measurement\n\n**Mean Time to Detect (MTTD):**\n```spl\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttd_seconds = _time - orig_time\n| where mttd_seconds > 0 AND mttd_seconds \u003C 86400  --- Exclude data quality issues\n| stats avg(mttd_seconds) AS avg_mttd,\n        median(mttd_seconds) AS med_mttd,\n        perc90(mttd_seconds) AS p90_mttd,\n        perc95(mttd_seconds) AS p95_mttd\n  by urgency\n| eval avg_mttd_min = round(avg_mttd \u002F 60, 1)\n| eval med_mttd_min = round(med_mttd \u002F 60, 1)\n| eval p90_mttd_min = round(p90_mttd \u002F 60, 1)\n| table urgency, avg_mttd_min, med_mttd_min, p90_mttd_min\n```\n\n**Mean Time to Respond (MTTR):**\n```spl\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttr_seconds = status_end - _time\n| where mttr_seconds > 0 AND mttr_seconds \u003C 604800  --- \u003C7 days\n| stats avg(mttr_seconds) AS avg_mttr,\n        median(mttr_seconds) AS med_mttr,\n        perc90(mttr_seconds) AS p90_mttr\n  by urgency\n| eval avg_mttr_hours = round(avg_mttr \u002F 3600, 1)\n| eval med_mttr_hours = round(med_mttr \u002F 3600, 1)\n| eval p90_mttr_hours = round(p90_mttr \u002F 3600, 1)\n| table urgency, avg_mttr_hours, med_mttr_hours, p90_mttr_hours\n```\n\n**MTTD\u002FMTTR Trend Over Time:**\n```spl\nindex=notable earliest=-90d status_label=\"Resolved*\"\n| eval mttd_min = (_time - orig_time) \u002F 60\n| eval mttr_hours = (status_end - _time) \u002F 3600\n| bin _time span=1w\n| stats avg(mttd_min) AS avg_mttd_min, avg(mttr_hours) AS avg_mttr_hours,\n        count AS incidents by _time\n| table _time, incidents, avg_mttd_min, avg_mttr_hours\n```\n\n### Step 3: Measure Alert Quality and Analyst Productivity\n\n**Alert Disposition Analysis:**\n```spl\nindex=notable earliest=-30d\n| stats count AS total,\n        sum(eval(if(status_label=\"Resolved - True Positive\", 1, 0))) AS tp,\n        sum(eval(if(status_label=\"Resolved - False Positive\", 1, 0))) AS fp,\n        sum(eval(if(status_label=\"Resolved - Benign\", 1, 0))) AS benign,\n        sum(eval(if(status_label=\"New\" OR status_label=\"In Progress\", 1, 0))) AS pending\n| eval tp_rate = round(tp \u002F total * 100, 1)\n| eval fp_rate = round(fp \u002F total * 100, 1)\n| eval signal_noise = round(tp \u002F (fp + 0.01), 2)\n| table total, tp, fp, benign, pending, tp_rate, fp_rate, signal_noise\n```\n\n**Analyst Productivity Metrics:**\n```spl\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| stats count AS alerts_resolved,\n        avg(eval((status_end - status_transition_time) \u002F 60)) AS avg_triage_min,\n        dc(rule_name) AS unique_rule_types\n  by owner\n| eval alerts_per_day = round(alerts_resolved \u002F 30, 1)\n| sort - alerts_resolved\n| table owner, alerts_resolved, alerts_per_day, avg_triage_min, unique_rule_types\n```\n\n**Shift-Based Workload Distribution:**\n```spl\nindex=notable earliest=-30d\n| eval hour = strftime(_time, \"%H\")\n| eval shift = case(\n    hour >= 6 AND hour \u003C 14, \"Day (06-14)\",\n    hour >= 14 AND hour \u003C 22, \"Swing (14-22)\",\n    1=1, \"Night (22-06)\"\n  )\n| stats count AS alerts, dc(owner) AS analysts by shift\n| eval alerts_per_analyst = round(alerts \u002F analysts \u002F 30, 1)\n| table shift, alerts, analysts, alerts_per_analyst\n```\n\n### Step 4: Track Detection Coverage\n\n**ATT&CK Coverage Score:**\n```spl\n| inputlookup detection_rules_attack_mapping.csv\n| stats dc(technique_id) AS covered_techniques by tactic\n| join tactic type=left [\n    | inputlookup attack_techniques_total.csv\n    | stats dc(technique_id) AS total_techniques by tactic\n  ]\n| eval coverage_pct = round(covered_techniques \u002F total_techniques * 100, 1)\n| sort tactic\n| table tactic, covered_techniques, total_techniques, coverage_pct\n```\n\n**Data Source Coverage:**\n```spl\n| inputlookup expected_data_sources.csv\n| join data_source type=left [\n    | tstats count where index=* by sourcetype\n    | rename sourcetype AS data_source\n    | eval status = \"Active\"\n  ]\n| eval source_status = if(isnotnull(status), \"Collecting\", \"MISSING\")\n| stats count by source_status\n| table source_status, count\n```\n\n### Step 5: Build Executive Reporting Dashboard\n\n**Monthly SOC Executive Summary:**\n```spl\n--- Incident summary by category\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| stats count by urgency\n| eval order = case(urgency=\"critical\", 1, urgency=\"high\", 2, urgency=\"medium\", 3,\n                    urgency=\"low\", 4, urgency=\"informational\", 5)\n| sort order\n\n--- Month-over-month comparison\nindex=notable earliest=-60d\n| eval period = if(_time > relative_time(now(), \"-30d\"), \"This Month\", \"Last Month\")\n| stats count by period, urgency\n| chart sum(count) AS incidents by urgency, period\n\n--- Top 5 incident categories\nindex=notable earliest=-30d status_label=\"Resolved - True Positive\"\n| top rule_name limit=5\n| table rule_name, count, percent\n```\n\n**Security Posture Scorecard:**\n```spl\n| makeresults\n| eval metrics = mvappend(\n    \"MTTD: 8.3 min (Target: \u003C15 min) | STATUS: GREEN\",\n    \"MTTR: 3.2 hours (Target: \u003C4 hours) | STATUS: GREEN\",\n    \"FP Rate: 27% (Target: \u003C30%) | STATUS: GREEN\",\n    \"Detection Coverage: 64% (Target: >60%) | STATUS: GREEN\",\n    \"Analyst Utilization: 78% (Target: 60-80%) | STATUS: GREEN\",\n    \"Incident Backlog: 12 (Target: \u003C20) | STATUS: GREEN\"\n  )\n| mvexpand metrics\n| table metrics\n```\n\n### Step 6: Implement Continuous Improvement Tracking\n\nTrack improvement initiatives and their impact:\n\n```spl\n--- Improvement initiative tracking\n| inputlookup soc_improvement_initiatives.csv\n| eval status_color = case(\n    status=\"Completed\", \"green\",\n    status=\"In Progress\", \"yellow\",\n    status=\"Planned\", \"gray\"\n  )\n| table initiative, start_date, target_date, status, metric_impact, baseline, current\n```\n\nExample initiatives:\n```csv\ninitiative,start_date,target_date,status,metric_impact,baseline,current\nRisk-Based Alerting,2024-01-15,2024-03-15,Completed,Alert Volume,-84%,287\u002Fday\nSigma Rule Library,2024-02-01,2024-04-01,In Progress,ATT&CK Coverage,61%,64%\nSOAR Phishing Playbook,2024-02-15,2024-03-30,In Progress,Phishing MTTR,45min,18min\nAnalyst Training Program,2024-01-01,2024-06-30,In Progress,TP Rate,31%,41%\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **MTTD** | Mean Time to Detect — average time from threat occurrence to SOC alert generation |\n| **MTTR** | Mean Time to Respond — average time from detection to incident resolution |\n| **MTTA** | Mean Time to Acknowledge — average time from alert generation to analyst assignment |\n| **Signal-to-Noise Ratio** | Ratio of true positive alerts to total alerts — higher is better |\n| **Dwell Time** | Duration an attacker remains undetected in the environment — key indicator of detection effectiveness |\n| **Analyst Utilization** | Percentage of analyst time spent on productive investigation vs. overhead tasks |\n\n## Tools & Systems\n\n- **Splunk Dashboard Studio**: Advanced visualization framework for building interactive SOC metric dashboards\n- **Grafana**: Open-source analytics and visualization platform supporting multiple data sources\n- **Power BI**: Microsoft business intelligence tool for executive-level reporting and trend analysis\n- **ATT&CK Navigator**: MITRE tool for visualizing detection coverage as layered heatmaps\n- **ServiceNow Performance Analytics**: ITSM analytics module for tracking incident lifecycle metrics\n\n## Common Scenarios\n\n- **Quarterly Business Review**: Present MTTD\u002FMTTR trends, detection coverage growth, and alert quality improvements\n- **Staffing Justification**: Use workload metrics to justify additional analyst headcount or shift adjustments\n- **Tool ROI Assessment**: Compare alert quality and response times before and after new tool deployment\n- **Compliance Evidence**: Provide documented SOC performance metrics for ISO 27001 or SOC 2 audits\n- **Vendor Comparison**: Benchmark SOC metrics against industry peers using surveys (SANS, Ponemon)\n\n## Output Format\n\n```\nSOC PERFORMANCE REPORT — March 2024\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nKEY METRICS:\n  Metric              Current    Target     Trend    Status\n  MTTD                8.3 min    \u003C15 min    -12%     GREEN\n  MTTR                3.2 hrs    \u003C4 hrs     -18%     GREEN\n  FP Rate             27%        \u003C30%       -5%      GREEN\n  TP Rate             41%        >40%       +3%      GREEN\n  ATT&CK Coverage     64%        >60%       +3%      GREEN\n  Alerts\u002FAnalyst\u002FDay  24         \u003C50        -84%     GREEN\n\nINCIDENT SUMMARY:\n  Total Incidents:     147 (Critical: 3, High: 23, Medium: 78, Low: 43)\n  Avg Resolution:      3.2 hours (Critical: 1.8h, High: 2.9h, Medium: 4.1h)\n  SLA Compliance:      94% (Target: >90%)\n\nIMPROVEMENT HIGHLIGHTS:\n  [1] RBA deployment reduced daily alerts from 1,847 to 287 (-84%)\n  [2] New Sigma rules added 12 ATT&CK techniques to coverage\n  [3] SOAR phishing playbook reduced phishing MTTR by 60%\n\nAREAS FOR IMPROVEMENT:\n  [1] Lateral movement detection coverage at 58% (below 60% target)\n  [2] Night shift MTTD 23% slower than day shift\n  [3] 4 critical vulnerability scan tickets overdue on SLA\n```\n",{"name":5,"tags":50,"author":51,"domain":34,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":59,"nist_ai_rmf":60,"mitre_attack":64,"atlas_techniques":67},[30,29,41,42,43,37,38,44],"mahipal","1.0",[54,55,56,57],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.\n",[61,62,63],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[65,66],"T1078","T1071",[68,69,70],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-soc-metrics-and-kpi-tracking",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-soc-metrics-and-kpi-tracking",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-soc-metrics-and-kpi-tracking",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-soc-metrics-and-kpi-tracking","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-metrics-and-kpi-tracking\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-metrics-and-kpi-tracking\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2469,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-metrics-and-kpi-tracking\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-soc-metrics-and-kpi-tracking\u002Fscripts\u002Fagent.py",[113,139,163,191,216,243],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":45},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,32,34,125,126,127,128,129,130,131,132,133,134,135,136,137,138],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":45},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[145],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,135,148,149,32,150,34,127,151,152,153,154,155,156,157,158,159,160,161,162],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":45},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[169,172],{"categoryNo":170,"categoryName":171,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,174,175,176,177,34,178,179,151,180,181,182,183,184,185,186,187,188,189,190],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":45},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,34,202,203,204,205,206,207,208,40,209,210,211,212,154,213,214,215],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":45},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,34,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":45},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[32,251,34,36,252,253,30,254,255,256,257,186,258,187,259,260,261,262,263,264],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]