Which metric is commonly used to measure the effectiveness of a SOC?

Mean Time to Detect (MTTD) is a critical Key Performance Indicator (KPI) for measuring the effectiveness of a Security Operations Center (SOC). It quantifies the average time elapsed from the moment a security threat or incident begins to when it is discovered by the security team. A lower MTTD indicates a more efficient and effective detection capability, as it signifies that threats are being identified more quickly, reducing the potential window for an attacker to cause damage. SOCs continuously strive to lower this metric through improved tooling, automation, and analyst training.

B. Sales Conversion Rate is a business metric used by sales and marketing teams to measure the effectiveness of their sales funnel.

C. Employee Satisfaction Index is a human resources metric used to gauge workplace morale and employee contentment, not security operations performance.

D. Server Uptime Percentage is an IT operations metric that measures system availability and reliability, not the effectiveness of security threat detection.

1. Palo Alto Networks. (2023). The Ultimate Guide to SOC Metrics. Palo Alto Networks Resources. In the "Detection Metrics" section, MTTD is listed as a primary metric, described as "the time it takes for your team to become aware of a threat."

2. Palo Alto Networks. (2023). Cortex XSOAR Administrator's Guide. Cortex XSOAR Documentation. The "Reports and Dashboards" section details the creation of widgets to track incident timelines, which directly contribute to calculating metrics like MTTD and MTTR.