<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-soc-metrics-analysis
description: >-
  SOC performance measurement and KPI tracking including MTTD, MTTR, alert
  volume trends, analyst throughput, detection coverage scoring, SLA
  compliance reporting, and executive dashboard generation across Splunk ES,
  Elastic Security, and Microsoft Sentinel.
domain: cybersecurity
subdomain: soc-operations
tags:
  - soc-metrics
  - kpi
  - mttd
  - mttr
  - sla
  - performance
  - siem
  - dashboard
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing SOC Metrics Analysis

## Overview

SOC metrics provide objective measurement of detection and response
effectiveness. Without data-driven metrics, SOC leadership cannot identify
staffing gaps, justify tooling investments, or demonstrate improvement over
time. This skill covers the core SOC KPIs, their calculation methods, and
reporting techniques across major SIEM platforms.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM access with reporting privileges | Metric extraction |
| Incident tracking system | Response time calculation |
| Historical data (90+ days) | Trend analysis |
| Stakeholder reporting requirements | Dashboard scope |

## Key Concepts

### Core SOC KPIs

```
SOC PERFORMANCE METRICS:
├── Detection Metrics
│   MTTD — Mean Time to Detect (threat present → alert fires)
│   Detection Coverage — ATT&CK techniques with active detections
│   Alert Fidelity — TP rate across all alerts
├── Response Metrics
│   MTTA — Mean Time to Acknowledge (alert → analyst assigns)
│   MTTR — Mean Time to Respond (alert → containment action)
│   MTTC — Mean Time to Close (alert → incident closed)
├── Operational Metrics
│   Alert Volume — Total alerts per shift/day/week
│   Analyst Throughput — Alerts triaged per analyst per shift
│   Escalation Rate — % of alerts escalated to T2/T3
│   SLA Compliance — % of alerts triaged within SLA
└── Quality Metrics
    FP Rate — % of alerts classified as false positive
    Reopened Incidents — Incidents reopened after closure
    Detection Gap Ratio — Known TTPs without detection rules
```

### Splunk ES Metrics Queries

```spl
-- MTTA calculation (alert creation to first status change)
index=notable status!="new"
| eval mtta_sec=first_status_change_time - _time
| stats avg(mtta_sec) as avg_mtta, median(mtta_sec) as med_mtta,
    perc95(mtta_sec) as p95_mtta by urgency
| eval avg_mtta_min=round(avg_mtta/60,1),
    med_mtta_min=round(med_mtta/60,1),
    p95_mtta_min=round(p95_mtta/60,1)

-- Alert volume trend (weekly, 90 days)
index=notable earliest=-90d
| timechart span=1w count by urgency

-- Analyst throughput per shift
index=notable status!="new"
| eval shift=case(
    date_hour>=0 AND date_hour<8, "night",
    date_hour>=8 AND date_hour<16, "day",
    1==1, "evening")
| stats dc(event_id) as alerts_handled by owner, shift
| stats avg(alerts_handled) as avg_throughput by shift

-- SLA compliance rate
index=notable
| eval sla_met=if(mtta_sec <= sla_target_sec, 1, 0)
| stats sum(sla_met) as met, count as total by urgency
| eval compliance_pct=round(met/total*100,1)
```

### Sentinel KQL Metrics

```kql
// MTTR by severity (last 90 days)
SecurityIncident
| where TimeGenerated > ago(90d) AND Status == "Closed"
| extend MTTR_hours=datetime_diff("hour", ClosedTime, CreatedTime)
| summarize AvgMTTR=avg(MTTR_hours), MedianMTTR=percentile(MTTR_hours, 50),
    P95_MTTR=percentile(MTTR_hours, 95) by Severity

// Weekly alert volume trend
SecurityAlert
| where TimeGenerated > ago(90d)
| summarize Count=count() by Week=startofweek(TimeGenerated), AlertSeverity
| render timechart
```

### Metric Targets Reference

```
INDUSTRY BENCHMARKS (adjust for environment):
  MTTA Critical:  < 5 minutes
  MTTA High:      < 15 minutes
  MTTA Medium:    < 60 minutes
  MTTR Critical:  < 4 hours
  MTTR High:      < 24 hours
  Alert Fidelity: > 30% TP rate
  SLA Compliance: > 95%
  FP Rate Target: < 50% per rule
```

## Workflow

1. **Define** — Establish KPIs aligned with SOC charter and SLAs
2. **Instrument** — Configure SIEM queries and dashboards for each metric
3. **Baseline** — Collect 90 days of data to establish baselines
4. **Analyze** — Identify trends, outliers, and improvement opportunities
5. **Report** — Generate weekly/monthly reports for stakeholders
6. **Improve** — Set targets and track progress against baselines
7. **Review** — Quarterly review of metric relevance and targets

## Verification

| Check | Method |
|---|---|
| All KPIs instrumented | Dashboard shows live data for each metric |
| Baselines established | 90-day historical data available |
| SLA compliance tracked | Automated alerts on SLA breaches |
| Trend analysis available | Week-over-week comparison functional |
| Reports delivered on schedule | Stakeholder receipt confirmed |
