Analyst Workload: Alerts per Analyst-Hour and the Queue
This lesson is part of the course
In this lesson
You measure the tier-1 workload over one day in four-hour blocks: alerts per analyst-hour, triage capacity, the queue left at the end of each block and the day's utilisation.
Buy the course once for $9.99 to unlock every lesson and lab, the final exam and the certificate – lifetime access, no subscription.
Lessons in this course
- Incident Timelines: MTTD, MTTR, Median and 90th Percentile Locked
- Alert Volume and True-Positive Rate per Detection Rule Locked
- Analyst Workload: Alerts per Analyst-Hour and the Queue Locked
- Vulnerability Backlog: CVSS Bands, SLA Days and Compliance Locked
- Patch Coverage by Asset Group Locked
- Phishing Simulations: Click Rate, Report Rate and the Trend Locked
- Risk-Based Prioritisation: CVSS × Exposure × Asset Value Locked
- Security KPI Dashboard: Targets, Direction and Flags Locked