A security operations center (SOC) manager is reviewing monthly performance metrics. They observe a consistent increase in the 'Number of Critical Alerts' generated by the SIEM, while the 'Mean Time To Acknowledge (MTTA)' these alerts has remained stable. To provide clear and actionable insights to the CISO, which additional metric would be MOST important to analyze alongside these two?
- ANumber of new threat intelligence feeds integrated.
- BPercentage of critical alerts that were false positives.
- CTotal number of security incidents closed per month.
- DAverage CPU utilization of SIEM servers.
Show answer & explanationAnswer & explanation
Correct answer: B. Percentage of critical alerts that were false positives.
An increase in critical alerts with stable MTTA suggests the team is acknowledging alerts consistently, but not necessarily that they are all legitimate threats. A high percentage of false positives would indicate alert fatigue, inefficient SIEM tuning, or alert noise, which reduces the effectiveness of the SOC and wastes resources. This metric provides critical context for the 'Number of Critical Alerts' trend and informs actionable improvements for the CISO.
Why the other options are wrong
- A. Integrating new feeds might *cause* an increase in alerts but doesn't explain the *quality* or actionability of the existing increasing critical alerts.
- C. While important, simply closing incidents doesn't explain *why* critical alerts are increasing or whether they are legitimate threats.
- D. This is an infrastructure performance metric, not directly related to the effectiveness of alert handling or the legitimacy of the alerts themselves.
SOC Alert Quality Metrics
Metrics that assess the accuracy and relevance of security alerts generated by monitoring systems, crucial for SOC efficiency and avoiding alert fatigue.
- Includes false positive rates and true positive rates.
- Helps justify SIEM tuning and rule refinement.
- Directly impacts analyst workload and ability to detect real threats.
Memory trick: More alerts, same acknowledge time? Are these alerts even REAL?