A security operations center (SOC) manager is reviewing Key Performance Indicators (KPIs) to evaluate the effectiveness of their threat intelligence program. The goal is to ensure that threat intelligence is actionable and directly contributes to defensive capabilities. Which of the following metrics would BEST indicate the program's success in achieving this goal?
- ATotal budget allocated to threat intelligence platforms.
- BPercentage of security alerts correlated with active threat intelligence.
- CNumber of unique threat intelligence feeds subscribed to.
- DVolume of threat indicators (IOCs) ingested per day.
Show answer & explanationAnswer & explanation
Correct answer: B. Percentage of security alerts correlated with active threat intelligence.
An effective threat intelligence program should make intelligence actionable by integrating it into existing security operations. The 'percentage of security alerts correlated with active threat intelligence' directly measures how well the ingested intelligence is being used to enrich and validate alerts, thus making detection more efficient and effective, and demonstrating its direct contribution to defensive capabilities.
Why the other options are wrong
- A. Budget allocation shows investment but not the operational effectiveness or success of the program.
- C. This measures quantity of sources, not the actionability or effectiveness of the intelligence.
- D. This measures the volume of raw data ingested, not how effectively it's being used to improve defenses.
Threat Intelligence Actionability KPI
A Threat Intelligence Actionability KPI measures the degree to which ingested threat intelligence is integrated into security tools and processes, directly enhancing detection, prevention, or response capabilities.
- Focuses on utilization, not just acquisition, of intelligence.
- Demonstrates value by improving security operations.
- Often involves correlation with alerts, blocks, or investigations.
Memory trick: Threat Intel: Get Smart, Get Actionable, Get Protected.