Security Incident Response & SOC Operations

InsureCore Mutual | Real-time SOC case tracking with IT linkage & regulatory compliance

Open Cases
14
+2 vs last week
MTTC (Confirmed)
6.2h
-1.4h (18% better)
Dwell Time P90
18h
Target <24h
Reg Clock Compliance
100%
All NYDFS met
Linked IT Incidents
3
Active cross-ref
Repeat Compromise
1
VPN Concentrator

SOC Case Pipeline (Last 30 Days)

Dwell Time Distribution

Incident Type Mix (30d)

Critical Cases & Asset Status

Case ID Type Severity Asset Tier Classification Status MTTC IT Link Reg Clock
SEC-2201 Lateral Movement CRITICAL Tier 1 PII/PHI Contained 5.8h P1-4821 ✓ 2h left
SEC-2198 Ransomware CRITICAL Tier 1 Financial Eradicating 7.1h P1-4819 ✓ 5h left
SEC-2195 Phishing (C2) HIGH Tier 2 Confidential Investigating 3.2h — 18h left
SEC-2187 Insider Threat MEDIUM Tier 2 PII Contained 12.4h P2-4807 ✓ Filed
SEC-2184 Malware (Worm) HIGH Tier 1 Financial Eradicating 6.9h — ✓ 12h left
SEC-2180 Data Exfil CRITICAL Tier 1 PII/PHI Recovery 8.7h — ✓ Filed

Playbook Execution Completion

IT Incident Linkage Flow

SOC Cases (14)
3 linked
IT Incidents (78)
3 linked
Linked Pairs (Active)
SEC-2201 ↔ P1-4821 (API Outage)
SEC-2198 ↔ P1-4819 (File Server Down)
SEC-2187 ↔ P2-4807 (Access Anomaly)
False Positive Triage Rate
8.2%
124 of 1,512 alerts dismissed
-2.1% vs last month
Avg Analyst Load
2.3
Cases per analyst (6 SOC staff)
Balanced across shifts
Eradication Pending
4
Cases awaiting final verification
Avg 18h to complete

Regulatory Notification Clocks (NYDFS 72h)

SEC-2201 (Lateral Movement) Contained • 2h / 72h remaining
SEC-2198 (Ransomware) Eradicating • 5h / 72h remaining
SEC-2195 (Phishing C2) Investigating • 18h / 72h remaining
SEC-2187 (Insider Threat) Contained • Filed on time
SEC-2184 (Malware Worm) Eradicating • 12h / 72h remaining
SEC-2180 (Data Exfil) Recovery • Filed on time

Repeat Compromise Alert

VPN Concentrator - Tier 1
Compromised twice in 90 days
• SEC-2143 (Day 12) - Credential stuffing
• SEC-2195 (Day 68) - Lateral movement
Hardening Epic Status
EPIC-447: MFA + IP whitelisting
In Progress • Sprint 12
Actions Taken
  • ✓ IR retainer engaged (Day 68)
  • ✓ Legal review initiated
  • ✓ Asset isolation enforced
  • ⏳ Hardening deployment (Est: 2 weeks)
SIEM Rule Version: v4.2.1 (Updated 2024-01-08) | Case Schema: SOC-IR-2024-Q1
Last refresh: 2024-01-15 14:23 UTC