Security Operations Metrics: MTTD, MTTR, Vulnerability SLAs & Alert Triage

What you'll build

What you will be able to do

Each lab ends with a concrete result that you build yourself and the checker confirms, cell by cell.

• Turn twelve incident timelines into hours to detect and to respond, then report the mean, median, 90th percentile and the P1-only median that a SOC manager actually needs.
• Summarise a week of triaged alerts by detection rule: alert counts, true positives, true-positive rate, and which noisy rules should be tuned first.
• Measure the tier-1 workload over one day in four-hour blocks: alerts per analyst-hour, triage capacity, the queue left at the end of each block and the day's utilisation.
• Look up the remediation SLA of fourteen findings from their CVSS score, count the days each has been open (or took to close), flag SLA breaches and report SLA compliance per severity band.
• Measure scan coverage, patch compliance and effective patch coverage for six asset groups, the company-wide figure, and how many assets each group must patch to reach the 95% target.
• Turn six monthly phishing simulations into click, report and credential rates, track reports per click and chart click rate against report rate.
• Score ten open findings by CVSS, exposure and asset value, rank them, compare with a CVSS-only ranking and measure how much of the total risk the top three hold.
• Finish Brightwater Mutual's quarterly SOC scorecard: the change against last quarter, an On track / Off track status that respects whether lower or higher is better, the number of KPIs off track and a red flag on each one.