5.2.2. SOC Metrics: MTTD, MTTR, and Alert Volume
💡 First Principle: SOC metrics only drive improvement when they're connected to root cause analysis — knowing that MTTD is 14 days is useless without knowing why (missing log sources? Insufficient correlation rules? Alert fatigue from too many false positives?) and acting on the answer.
Core SOC Performance Metrics:
| Metric | Full Name | Formula | What a High Value Indicates |
|---|---|---|---|
| MTTD | Mean Time to Detect | Avg time from incident start to detection | Poor visibility, missing log sources, weak correlation rules, alert fatigue |
| MTTR | Mean Time to Respond | Avg time from detection to containment | Slow playbook execution, insufficient automation, unclear escalation paths |
| MTTRemediate | Mean Time to Remediate | Avg time from detection to full remediation | Slow patching, complex eradication, approval bottlenecks |
| Alert Volume | Total alerts per period | Count | Rising alert volume = either increasing threats or degrading tuning (more false positives) |
Alert Volume and the False Positive Problem:
Alert volume by itself isn't meaningful — it needs context. An organization with 50,000 alerts/day and 99% false positive rate has 500 real alerts drowning in 49,500 noise events. The ratio of true-positive alerts to total alerts is a critical tuning metric.
High alert volume creates alert fatigue: analysts process so many low-quality alerts that they start dismissing alerts without proper investigation, which is exactly when real threats slip through. SOC managers should track:
- True positive rate per rule — Rules generating mostly false positives should be tuned or disabled
- Escalation rate — What % of Tier 1 alerts escalate to Tier 2? Very low rates suggest either Tier 1 over-closing, or genuinely low-risk environment (unusual)
- Alert age — How long do alerts sit before being worked? Aging real alerts = capacity problem or triage failure
Using Metrics for Continuous Improvement:
⚠️ Exam Trap: MTTD and MTTR are averages — they can be misleading if a few severe outlier incidents skew the mean. A SOC reporting "MTTD: 2 hours average" could have 90% of incidents detected in 30 minutes and one incident (a sophisticated APT) undetected for 30 days. Always look at distribution, not just mean, for meaningful performance insight.
Reflection Question: A SOC reports these metrics for Q3: MTTD improved from 18 days to 4 days; MTTR remained flat at 72 hours; alert volume increased 300%. What improvements likely drove the MTTD reduction? What does the flat MTTR suggest, and what does the 300% alert volume increase imply about the new detection capabilities?
