Which of these describes SOC metrics in relation to security incidents?

A primary goal of a Security Operations Center (SOC) is to minimize the impact of security incidents. This is measured using key performance indicators (KPIs), which are often time-based. The "time it takes to detect the incident," commonly known as Mean Time to Detect (MTTD), is a critical SOC metric. It measures the average time elapsed from when a security threat first appears in an environment to when the SOC identifies it. A lower MTTD indicates a more effective and efficient security monitoring and detection capability, which is a core function of any SOC.

B. time it takes to assess the risks of the incident: This is a component of the analysis phase within the overall incident response time, not a standalone, primary SOC metric like MTTD or MTTR.
C. probability of outage caused by the incident: This is a risk assessment factor used to determine the potential impact of an incident, not a metric measuring the SOC's operational performance.
D. probability of compromise and impact caused by the incident: These are core components of a risk analysis (Likelihood x Impact), which informs the SOC's prioritization, but they do not measure the SOC's efficiency.

1. Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Chapter 1

"Cybersecurity and the Security Operations Center

" Section: "SOC Metrics." This section explicitly lists "Mean time to detect (MTTD)" as a common metric used to measure SOC effectiveness

defining it as "the average time that it takes for the security team to identify a security incident."

2. Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology.

Section 2.3.3

"Incident Response Metrics." This section emphasizes the importance of metrics for improving incident response capabilities. It states

"Metrics can be used to measure the success of an incident response program... Examples of information that organizations may want to collect include... how long it took to detect and assess damage and scope for each incident." This directly supports measuring detection time as a key activity.

3. MITRE. (2021). 11 Strategies of a World-Class Cybersecurity Operations Center. The MITRE Corporation.

Strategy 3

"Measure Performance to Improve Performance

" Section: "What to Measure." The document lists "Mean Time to Detect (MTTD)" as a foundational metric

describing it as the time from the start of an incident to the moment the SOC detects it. It highlights that reducing MTTD is a primary goal for improving security posture.