Question

As a SecOps engineer, you are building a monthly observability report for leadership. Over the past quarter, the SOC has authored 40 new detection rules. Leadership wants a single trend metric that reveals whether the detection engineering program is producing rules that analysts actually find actionable over time, rather than adding to alert fatigue. Which metric best measures this?

Accepted Answer

The trend in the ratio of true-positive to total alerts (precision) per rule, tracked month over month

Answer

The total number of detection rules deployed to the live state each month

Answer

The average daily events-per-second ingested across all log sources

Answer

The number of MITRE ATT&CK techniques with at least one mapped rule