Chapter 6 of 13 · Months 1–3
Metrics that measure you and metrics that help
- Am I being judged on how many tickets I close?
- What do MTTD and MTTR really mean?
- Which numbers should I care about?
SOCs love numbers. Some help you get better. Some are easy to read the wrong way. It is worth knowing the common ones before someone shows you a dashboard with your name on it.
| Metric | What it means | What to watch for |
|---|---|---|
| MTTD (mean time to detect) | Average time from when something bad started to when it was detected. | You only know the start time for incidents you found, so it leaves out what you missed. |
| MTTR (mean time to respond or resolve) | Average time from detection to containment or closure. Teams define the end point differently. | Ask which end point your team uses. Closing quickly is not the same as fixing. |
| Alerts closed per shift | How many alerts an analyst worked. | Easy to raise by closing without checking. Rarely a sign of quality on its own. |
| False positive rate per rule | How often a rule fires on nothing bad. | Useful for tuning. A rule, not a person, owns this number. |
| Escalation accuracy | How often your escalations turned out to need escalating. | Too high can mean you only escalate when sure, and miss the unclear ones. |
Using MTTD and MTTR honestly
Averages hide the cases that matter. One incident that took weeks to detect sits in the same average as dozens found in minutes. If your team reports these numbers, ask to see the slowest few cases too. Those are where the lessons are.
Also ask how the clock is started and stopped. If "respond" ends when the ticket is closed, then closing faster improves the number without making anyone safer.
Numbers that help you personally
- How many of your closed alerts were later reopened.
- Which alert types you still need help with.
- How long your tickets sit before someone else can act on them.
The question you might not ask out loud
Am I being judged on how many tickets I close?
Ask your lead. It is a normal question. A good answer talks about quality: reopened tickets, clear notes, sensible escalations. If the answer is only volume, you now know what pressure you will be under and can plan for it.
Numbers are a starting point for a conversation, not the end of one. When a metric looks bad, ask what is behind it before deciding anything.
Rule of thumb:Rule of thumb: any number that can be improved by doing less checking will be, unless someone also watches quality.