SOC Efficiency & Analyst Performance Dashboard

GlobalEnergy Corp Security Operations Center — Real-time operational view

P1 MTTC (hrs)
6.8
+13% vs target
Target: <4.0h
Alert Fatigue Ratio
74:1
Top rule: 91:1
FP per TP (worst rule)
Escalation Accuracy
82.3%
Range: 68-94%
Tier-1 to Tier-2
Playbook Coverage
58%
Lat.Mvmt: 34%
P2+P3 categories
P1 SLA Breach
8.2%
12.1% Mo.3
Threshold: <5%
P1 Reopen Rate
2.1%
Within target
Target: <5%

Mean Time to Contain — 13-Week Trend by Severity Tier

Top 10 Alert Fatigue Rules (FP:TP Ratio)

Detection Rule Coverage & Utilization

Active rules triggered (90d) 76%
218 of 287 rules
High-fidelity rules (<10:1 FP:TP) 34%
74 rules (28% of triggered)
Rules requiring tuning (>50:1 ratio) 18%
39 rules — priority tuning targets
Action Required
"Outbound Port Scan" rule generating 91:1 ratio — tune subnet exclusions to reduce Tier-1 cognitive load.

Shift Queue Depth Distribution

Playbook Automation Coverage

58%
Overall P2+P3 coverage
Phishing 87%
Malware Detonation 72%
DLP Policy Violation 64%
Lateral Movement 34%
91st pctile volume, 34% coverage

SOAR Playbook Reliability

13.7%
Failure rate (error/timeout)
Week 1 21.0%
Week 6 15.3%
Week 13 (current) 13.7%
Trend: Improving
35% reduction since period start

Analyst Performance Summary (Last 90 Days)

Analyst ID Tier Shift Alerts Closed Escalation Accuracy Avg Queue Depth MTTC P1 (hrs) Status
A01 T1 Day 1,247 89.2% 23 5.8 Healthy
A02 T1 Day 1,184 91.4% 21 5.2 Healthy
A03 T1 Swing 1,092 86.7% 28 6.4 Healthy
A04 T1 Swing 891 68.3% 31 8.7 Training Needed
A07 T1 Overnight 743 74.1% 54 9.8 Overloaded
A09 T1 Overnight 982 82.9% 36 7.1 Elevated Load
A12 T2 Day 287 94.1% 12 4.3 Healthy
A14 T2 Swing 312 92.8% 14 4.7 Healthy
Team Aggregate 28 analysts (18 T1, 8 T2, 2 T3) 24,836 82.3% 27 6.8 Needs Improvement
Critical Alert: Analyst A07 (overnight shift) showing sustained queue depth 54 alerts/shift start — 2.4× team median. Weeks 3-4 analyst leave surge correlated with P1 MTTC spike to 9.4h. Recommend immediate capacity rebalancing.

SLA Breach Rate Trend (P1/P2/P3)

Threat Hunt Campaign Yield

Campaign Assets Scanned TPs Found Yield Rate
C3: Lateral Movement (SMB) 243 7 2.88%
C5: Persistence (Scheduled Tasks) 187 4 2.14%
C7: Kerberoasting 100 0 0.00%
C9: Webshell Indicators 312 9 2.88%
C11: C2 Beaconing (DNS) 156 3 1.92%
C12: Cloud API Abuse 89 1 1.12%
Average Yield 181 4.0 1.82%
Campaign C7 (Kerberoasting) yielded 0 TPs across 100 assets — refine hunt hypothesis or deprioritize.

Incident Reopen Analysis (P1+P2, Last 90 Days)

Incident ID Severity Category Initial Close Date Reopen Date Days to Reopen Reopen Reason Assigned To
INC-7821 P1 Lateral Movement 2024-10-14 2024-10-19 5 Redetection on same subnet A12
INC-8102 P2 DLP Violation 2024-11-03 2024-11-08 5 Incomplete user device remediation A03
INC-8247 P2 Phishing 2024-11-18 2024-11-21 3 Mailbox still had malicious payload A09
INC-8394 P1 Malware Detonation 2024-12-02 2024-12-08 6 Secondary persistence mechanism missed A14
INC-8511 P2 Privilege Escalation 2024-12-11 2024-12-15 4 User creds not rotated A01
Overall Reopen Rate (P1) 2.1% (within <5% target)
Root Cause Pattern: 3 of 5 reopens trace to incomplete containment steps (mailbox cleanup, cred rotation, persistence sweep). Recommend checklist enforcement in SOAR playbooks.

Environment Context

OrganizationGlobalEnergy Corp SOC
Total Analysts28 (18 T1, 8 T2, 2 T3)
Alert Volume (90d)24,836 processed
SIEM PlatformSplunk Enterprise Security
SOAR PlatformPalo Alto Cortex XSOAR
TicketingServiceNow Security Operations

Current Quarter OKRs

O1: Reduce P1 MTTC to <4.0 hours
Current: 6.8h | Gap: +70% | Blocker: Alert fatigue + overnight queue depth
O2: Achieve 90%+ Tier-1 escalation accuracy
Current: 82.3% | Gap: 7.7pts | Action: A04 training, playbook clarity
O3: Automate 75% of P2+P3 categories
Current: 58% | Priority: Lateral Movement (34% coverage, high volume)