---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Analyze security operations

# Analyze security operations {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Analyze security operations metrics agentic workflow helps security operations center managers analyze the performance of their security teams.

## The Analyze security operations metrics agentic workflow overview {#now-assist-sir-soc-efficiency-usecase__section_l3f_wyz_t2c}

Security operations center (SOC) managers can analyze metrics for overall case volume, mean time to assign (MTTA), and mean time to resolve (MTTR) on security incident response (SIR) records to give them insight into their security analysts' performance. They can also ask for recommendations for how to improve the metrics.

## Agents used in the Analyze security operations metrics agentic workflow {#now-assist-sir-soc-efficiency-usecase__section_tww_nzz_t2c}

* Security incident retrieval AI agent
* Security metrics analysis AI agent
{#now-assist-sir-soc-efficiency-usecase__ul_bjv_qzz_t2c}

## Tools mapped to the Analyze security operations metrics agentic workflow {#now-assist-sir-soc-efficiency-usecase__section_jsl_szz_t2c}

The following tools are mapped to the AI agents that are used in the Analyze security operations metrics agentic workflow.{#now-assist-sir-soc-efficiency-usecase__table_wt1_wzz_t2c__entry__4}

| Tool type | Execution mode | Name | Description |
|-|-|-|-|
| Script | Autonomous | Lookup security incidents | This tool invokes the script with the correct input from the user's query to retrieve the security incidents from the database. |
| Script | Autonomous | Analysis | Provides further analysis for a specified metric type, analyst, group, startDate, endDate, to SOC performance. |
| Script | Autonomous | Calculation | Calculates performance metrics for SOC managers such as mean time to resolve (MTTR) and mean time to assign (MTTA). |
| Script | Autonomous | Recommend | Recommends managerial actions that could be taken based on an analysis of a metric. |
[ ]

{#now-assist-sir-soc-efficiency-usecase__table_wt1_wzz_t2c}

## Triggers for the Analyze security operations metrics agentic workflow {#now-assist-sir-soc-efficiency-usecase__section_dxz_bc1_52c}

There are no triggers for this use case. If required, you can add a trigger to invoke the use case automatically.