Locating data for metrics
Once we’ve selected an appropriate mix of KPIs for our team, we need to source the data or instrument our solutions to poll the data at a regular interval for reporting. The best part of instituting a detection-as-code program is that we have set up the infrastructure to produce insights and data points for many of our common strategic and operational needs. Where we source the data can generally be narrowed down to a few locations for efficient polling:
- SIEM: This aggregates logging to measure downstream detection runtimes and sometimes case management dispositions.
- Code repositories: Providing you have metadata in each use case, counts can be tallied using scripts.
- Workflow management: Ticketing solutions, such as Jira, support labels for measuring work overtime and the type of work. In some SOC workflows, Jira is used for case management, too.
The following is a table that provides ways of sourcing each suggested KPI operationally...
