Security Operations Metrics: MTTD, MTTR, Vulnerability SLAs & Alert Triage
Measure a SOC from synthetic logs: incident MTTD and MTTR with medians and percentiles, true-positive rate per detection rule, analyst workload and queues, CVSS bands and SLA compliance, patch coverage, phishing trends, risk-based prioritisation and a flagged KPI scorecard, every cell checked as you go.
The first lesson is free — no account needed.
About this course
A security operations metrics course that measures one fictional company's security operations centre from synthetic logs in a spreadsheet, for SOC analysts and managers, security engineers, GRC and risk teams and cybersecurity students. You turn twelve incident timelines into mean time to detect and respond and report the median, 90th percentile and P1-only figures, summarise a week of alerts by detection rule with the true-positive rate and find the noisy rules to tune, measure alerts per analyst-hour, triage capacity and the queue, look up remediation SLAs from CVSS scores and report SLA compliance per severity band, measure scan coverage and patch compliance per asset group, track phishing click and report rates, prioritise findings by CVSS × exposure × asset value and finish a quarterly KPI scorecard with direction-aware red flags. Synthetic data, educational only. The first lab is free.
Lessons
- Incident Timelines: MTTD, MTTR, Median and 90th PercentileFree
- Alert Volume and True-Positive Rate per Detection Rule Pro
- Analyst Workload: Alerts per Analyst-Hour and the Queue Pro
- Vulnerability Backlog: CVSS Bands, SLA Days and Compliance Pro
- Patch Coverage by Asset Group Pro
- Phishing Simulations: Click Rate, Report Rate and the Trend Pro
- Risk-Based Prioritisation: CVSS × Exposure × Asset Value Pro
- Security KPI Dashboard: Targets, Direction and Flags Pro