Threat Detection & Incident Response Intelligence

FinShield Corp SOC | 3,200 endpoints | Last 30 days

Last updated

Dec 18, 2024 14:32 UTC

MTTD

42m

54% vs last month

MTTC

3.8h

39% vs 6.2h

Alert Fidelity

31%

+13pp from 18%

TTP Coverage

68%

+5pp vs Q3

EDR Coverage

94%

+2pp this week

Exploit Attempts

142/d

18% vs last week

MTTD & MTTC Trend — Last 30 Days

Detection Rule Signal-to-Noise Leaderboard

Rule Name	Alerts	True +	SNR	Action
Pass-the-Hash Attempt	127	41	3.1	Keep
Lateral Auth Anomaly	94	28	3.4	Keep
Kerberoasting Detection	63	17	3.7	Keep
Suspicious PowerShell	1,842	87	21.2	Tune
Office Macro Exec	2,104	34	61.9	Suppress
DNS Tunneling	412	19	21.7	Tune
Failed RDP Brute Force	3,287	12	273.9	Suppress
Mimikatz Signature	18	14	1.3	Keep

MITRE ATT&CK TTP Coverage

Lateral Movement Indicator Frequency

Threat Actor Attribution

TA505 (Pass-the-Hash) 41 events

APT29 (Kerberoasting) 17 events

Unknown (DNS Tunneling) 19 events

FIN7 (Living-off-the-Land) 8 events

Open Critical Vulnerabilities by Exploitability

CVE ID	Asset	CVSS	Exploit Pub	Age (days)	Status
CVE-2023-46604	prod-app-03	10.0	Public	127	Patching
CVE-2023-44487	lb-frontend-01	9.8	Public	94	Patching
CVE-2024-21762	vpn-gateway-02	9.6	Public	63	Testing
CVE-2023-36884	ws-finance-12	9.8	PoC	51	Testing
CVE-2024-3400	fw-perimeter-01	10.0	Public	38	Patching
CVE-2023-27350	pbx-voip-core	9.8	Public	29	Scheduled

Alert Fidelity Trend (12wk)

Mean Time to Escalate

Incident Severity Distribution

Endpoint Telemetry Coverage by Environment

Top Detection Gaps

T1070 - Indicator Removal

T1048 - Exfiltration Over Alternative

18%

T1547 - Boot/Logon Autostart

22%

T1078 - Valid Accounts

41%

T1055 - Process Injection

87%

SOC Capacity Utilization

78%

Alert triage workload

SOAR Playbook Coverage

Phishing Response 100%

Malware Containment 94%

Lateral Movement 87%

Data Exfiltration 63%

Insider Threat 41%

Analyst Performance

Avg. Triage Time

8.2min

Escalation Accuracy

91%

Cases Closed/Analyst

34/day