Deep dive into four Advanced Reports
This article will focus on the following four reports:
Performance Analysis – Handling times
Performance Analysis – Analysts Workload
Security Posture and Sensors Performance
Performance Analysis – Handling times
Description | Example |
---|---|
MTTD – Mean Time To Detect |
|
MTTR – Mean Time To Remediate |
|
Avg. Handling Time per SOC Role |
|
Avg. Handling Time per Stage |
|
Mean time to Triage |
|
Avg. Handling Time Triage Stage Displays the average handling time of the Triage stage per date. |
|
Avg. Handling Time per SOC Role per Date |
|
Performance Analysis – Analysts Workload
Alert Distribution across Rules
Displays the distribution and percentage of alerts per rule type.
Event Distribution across Rules
Displays the percentage of events per rule type.
Open Vs Closed Cases
Displays
the distribution of the number of open and closed cases.
Cases vs Alerts
Displays the
distribution of the number of cases and alerts.
False positives vs. Handling time
A dual axis graph displays the false positive rate on the left side
axis vs. the average handling time on the right axis.
The false positive
rate is the percentage of non-malicious cases out of all cases.
The
average handling time is the time from case creation to case closure.
The
graph displays information regarding closed cases only.
Security Posture and Sensors Performance
% of Alerts per Rule
Displays
the distribution and percentage of alerts per rule type.
Number of Alerts per Rule per Date
Displays the number of alerts per rule type per date.
% of Alerts per Product
Displays the distribution and percentage of alerts per product.
Number of Alerts per Product per Date
Displays the number of alerts per product per date.
False Positive Rate Vs Product
Displays the false positive rate per product type.
The false
positive rate is the percentage of non-malicious cases out of all cases.
The
graph displays information regarding closed cases only.
Playbook Analysis
Top 10 Automated Alerts
Displays the top 10 rules with the highest percentage of automated
alerts.
An automated alert is an alert that has an automatically attached
playbook.
Top 10 Alerts closed by automation
Displays the top 10 rules with the highest percentage of alerts that
were automatically closed by a playbook.
The graph displays information
regarding closed cases only.
False positives vs Handling time for non automated Alerts
For alerts which do not have an automatically attached playbook, the
widget has a dual axis graph that displays the false positive rate on the left
side axis vs. the average handling time on the right axis.
The graph
displays information regarding closed cases only.
The graph is empty in
case there are no alerts without a playbook.