Analyst Efficiency tab

This tab offers key indicators to assess individual analyst workload and performance, including:

• Average security incidents worked per analyst: Tracks the average number of open incidents handled by each analyst during a selected period.
• Closed security incidents per analyst: Measures total incidents closed by analysts in a given category and timeframe.
• Average security incident resolution: Shows the average time taken by analysts to close incidents, presented in days.
• Average security incident age: Indicates how long incidents remain open on average per analyst.
• Security incident backlog and closed incident analyses: Enables comparison of open and closed incidents across analysts, groups, priorities, and dates.
• Security incident age and resolution time: Provides insights into the duration incidents remain open and the time to resolution, filterable by assignment, priority, and other criteria.

These metrics empower SOC managers to identify bottlenecks, balance workloads, and optimize incident resolution processes.

Detection and Response Effectiveness tab

This section measures the accuracy and efficiency of detection and response efforts by tracking:

• True positive incidents: Percentage of correctly identified security incidents.
• False positive critical incidents: Percentage of false positive incidents classified with critical risk.
• Mean false positive risk score: Average risk score of false positives, indicating analyst time spent on low-value investigations.
• False positive security incident duration: Average time analysts spend investigating false positives.
• Security incident source effectiveness: Percentage of true positives identified by various sources (e.g., email, network activity), helping evaluate which detection sources are most reliable.
• Security incident source volume analysis: Tracks incident counts by source, allowing trend comparisons over time.
• Backlog and closed incident analysis: Monitors open incident counts, average open durations, total closed incidents, and resolution times within the period.

This tab enables SOC managers to improve detection accuracy, reduce false positives, and optimize resource allocation.

Incident Risk Score Analysis tab

This tab focuses on incident risk to prioritize SOC efforts effectively:

• Total risk exposure analysis: Shows counts of open incidents by risk category (low, moderate, critical) and allows comparison over time.
• Normalized security analyst work by risk score: Aggregates risk scores of true positive incidents closed by each analyst minus false positives, highlighting effective analyst contributions.
• Security analyst work by mean risk score: Displays average risk score per analyst, helping managers understand analyst workload quality.

Security Incident Stage Analysis tab

Provides visibility into the lifecycle of open incidents by tracking their current stage (e.g., analysis, contain, eradicate) and related metrics such as average age, affected configuration items, and response tasks. Managers can drill down for detailed breakdowns to monitor progress and resource allocation at each stage.

Practical Benefits for ServiceNow Customers

• Enables SOC managers to monitor and improve individual and team performance efficiently.
• Supports data-driven decision making to reduce incident resolution times and backlog.
• Helps identify and reduce false positives, improving resource utilization.
• Provides risk-focused insights to prioritize critical incidents and analyst efforts.
• Offers detailed lifecycle tracking to manage incident stages and response activities effectively.

By leveraging these insights, ServiceNow customers can optimize their security operations, enhance detection accuracy, and improve overall SOC productivity.