building-soc-metrics-and-kpi-tracking

Compute MTTD by subtracting orig_time from _time on resolved notables in index=notable, and MTTR by subtracting _time from status_end. Aggregate with stats avg, median, and perc90 grouped by urgency, filtering out outliers that indicate data quality issues.

Core SOC KPIs include MTTD, MTTA, MTTR, false positive rate, true positive rate, ATT&CK detection coverage, dwell time, escalation rate, and analyst utilization. Align each metric to NIST CSF functions and set targets such as MTTD under 15 minutes and FP rate under 30%.

Join a lookup mapping detection rules to technique IDs against a lookup of total ATT&CK techniques by tactic, then compute coverage percentage per tactic. Verify the join key format matches on both sides, since sub-technique versus technique ID mismatches inflate or undercount coverage.

Null MTTR usually means the status_end field is not populated by your Enterprise Security version, or resolution timestamps live in the incident_review dataset instead. Validate each timestamp field is non-null on resolved notables before publishing the scorecard.

Metrics should drive process improvement, not punitive individual performance management. Use workload and triage-time data for staffing decisions and shift balancing rather than ranking analysts against each other.