Threat Intel
SOC metrics that actually matter (and the ones that don't)
Alert counts measure noise, not safety. The metrics we report to clients, and why mean time to contain beats every vanity number.
SAMO SOC · · 5 min read
A SOC that proudly reports millions of blocked events is telling you about its firewall, not its effectiveness.
What we measure
- Mean time to detect (MTTD) for true positives
- Mean time to contain (MTTC), from first signal to isolation
- Detection coverage mapped to MITRE ATT&CK techniques
- Percentage of pentest findings converted into detections