SOC_Metrics.txt

Recommended Fields for Metric Collection
DateTime Occurred
DateTime Detected
DateTime Contained
DateTime Expelled
DateTime Owner Notified
DateTime Escalated
Recommended Mitigation
Severity
Source Use Case
Source Signature
Origination
MITRE ATT&CK Technique
Recommended Metrics
Average Cost Per Incident
Average Time to Detect
Average Time to Escalate
Average Time to Contain
Average Time to Expel
Average Time to Notify
Incidents Opened in a given time frame
Incidents Closed in a given time frame
Count of Incidents per Recommended Mitigation
Count of Incidents per Severity
Count of Incidents per Severity Not Reviewed Within Required Time
Count of Incidents per Alert/Rule/Signature
Count of Incidents per Use Case
Count of False Positive Incidents Per Use Case
Count of Incidents per Attack Technique