Analyst Efficiency tab

This tab provides key indicators related to analyst productivity and incident handling, including:

• Average security incidents worked per analyst: Measures the average number of open incidents each analyst manages within a timeframe.
• Closed security incidents per analyst: Tracks the total incidents closed by each analyst, categorized as needed.
• Average security incident resolution: Calculates the average days taken by analysts to close incidents.
• Average security incident age: Shows how long incidents remain open on average per analyst.
• Security incident backlog analysis: Displays total open incidents, with breakdown options by analyst, group, priority, and month-to-month comparisons.
• Closed security incident analysis: Provides counts of closed incidents with breakdowns similar to backlog analysis.
• Security incident age and resolution time: Allows detailed drill-down by assignment group, priority, or individual analyst to evaluate incident aging and resolution durations.

Drill-down capabilities enable SOC managers to explore detailed data behind each indicator for targeted performance review.

Detection and Response Effectiveness tab

This tab focuses on the quality and effectiveness of incident detection and analyst response by presenting metrics such as:

• True positive incidents: Percentage of correctly identified security incidents.
• False positive critical incidents: Percentage of false positives among critical risk incidents, helping to identify inefficiencies.
• Mean false positive risk score: Average risk score of false positives, indicating analyst time spent on non-threats.
• False positive security incident duration: Average days spent investigating false positives.
• Security incident source effectiveness: Percentage of true positives by incident source, such as email or network activity, to assess source reliability.
• Security incident source volume analysis: Counts of closed incidents per source type, with month-over-month comparisons.
• Security incident backlog and closed incident analysis: Provides volume and age/resolution time details for open and closed incidents respectively.

Incident Risk Score Analysis tab

This tab helps managers understand risk exposure and workload distribution by risk level with indicators like:

• Total risk exposure analysis: Number of open incidents per risk category (low, moderate, critical), including comparisons across time periods.
• Normalized security analyst work by risk score: Summarizes total risk score of true positive incidents closed by each analyst, adjusted for false positives.
• Security analyst work by mean risk score: Shows the average risk score per analyst over the selected period, factoring in false positives.

Security Incident Stage Analysis tab

Provides a snapshot of open incidents on a specific day, categorized by stage such as analysis, containment, eradication, and recovery. It includes metrics like average incident age, affected Configuration Items (CIs), and response tasks, with options to drill down for detailed views and breakdowns.

Practical Benefits for ServiceNow Customers

• Enables SOC managers to track and improve analyst productivity and incident resolution efficiency.
• Helps identify and reduce false positive incidents, saving analyst time and focusing efforts on true threats.
• Provides detailed risk exposure insights to prioritize security efforts effectively.
• Facilitates continuous performance monitoring and benchmarking through customizable breakdowns and period comparisons.
• Supports informed decision-making to optimize SOC operations and resource allocation.