Threat Detection & Incident Response Velocity

NovaSentinel Corp SOC Metrics — March 2024

Avg MTTD
38 min
-32% vs baseline
MTTR P1 (SLA: 60m)
47 min
+18% spike on 3/18
Alert-to-Incident Conv.
8.4%
Stable
91.6% FP rate
Containment Success
92%
+3% post-playbook update
Target: 95%
SOC Queue Depth
37
-74% from peak (143)
Open incidents
Analyst Throughput
14.2
Alerts/hour/analyst
L1 capacity: 87%

Detection & Response Velocity — March 2024

Alert Escalation Funnel

Dwell Time Distribution

MTTD vs Containment Success by Threat Category

SOC Queue Depth by Age Bucket

False Positive Rate by Detection Rule

Threat Category Performance Breakdown

Threat Category MTTD (min) MTTR P1 (min) Contain. Success Alert Volume Conv. Rate Trend
Phishing423896%1,84712.3%
Credential Stuffing2820281%3,2146.1%
Lateral Movement315694%41218.7%
Malware Execution193498%6899.4%
Data Exfiltration478989%20321.2%
Brute Force6312485%2,8913.8%
C2 Callback264197%31814.5%
Privilege Escalation356793%15416.9%

Incident Recurrence by Root Cause

Containment Success by Playbook

Phishing Triage v3.2 96%
Malware Contain v2.8 98%
Lateral Movement v1.4 94%
Credential Abuse v2.1 81%
Data Exfil Block v1.9 89%