Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

The investment in a Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and a ticketing system is aimed at improving the efficiency and effectiveness of the security operations lifecycle. A SIEM's primary function is to aggregate logs and correlate events to identify threats more rapidly. Therefore, the Mean Time to Detect (MTTD) is the most direct metric to measure the performance improvement of the new detection capabilities. A reduction in MTTD would demonstrate a clear return on investment by showing that the organization can identify security incidents faster than before the new systems were implemented.

B. Number of exploits by tactic: This is a threat intelligence metric that describes external attacker behavior, not the performance or efficiency of the organization's internal security tools.

C. Alert volume: A high alert volume is often a negative indicator, suggesting poor SIEM tuning and an excess of false positives, which can lead to analyst fatigue.

D. Quantity of intrusion attempts: This metric measures the volume of external threat activity against the organization, which is a factor the new internal systems do not control.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 3.4.2

Incident Response Metrics

discusses the importance of tracking time-based metrics. It states

"For example

it may be useful to measure the time from the discovery of an incident to the time that the system is back online." This principle directly supports measuring detection time (MTTD) as a key performance indicator.

2. Al-issa

Y. (2015). Building a World-Class Security Operations Center: A Roadmap. SANS Institute InfoSec Reading Room.

Page 17

Section "Key Performance Indicators (KPIs)"

explicitly lists "Mean Time to Detect (MTTD)" as a critical metric for a Security Operations Center (SOC). The paper emphasizes that metrics should measure the effectiveness of the SOC's people

processes

and technology

which is precisely what the question asks.

3. Jaatun

M. G.

& Tøndel

I. A. (2019). On Security Metrics for Security Information and Event Management (SIEM) Systems. In 2019 12th International Conference on IT Security Incident Management & IT Forensics (IMF) (pp. 64-75). IEEE.

Section IV.B

"Time-based metrics"

discusses the relevance of MTTD. The authors note

"Mean Time To Detect (MTTD) is a common metric for incident response teams... A SIEM system should contribute to reducing the MTTD." This academic source directly links SIEM implementation to the MTTD metric. DOI: 10.1109/IMF.2019.00013