security threats. The organization wants to avoid overwhelming analysts with excessive information and focus on the most critical security alerts to ensure timely responses to potential threats…

Question

Options

• AInclude as much data as possible to ensure complete visibility
• BRestrict dashboard access to only network administrators
• CPrioritize critical information and remove unnecessary details
• DUse only historical data to avoid real-time inconsistencies

• A
  3% (1)
• B
  8% (3)
• C
  87% (34)
• D
  3% (1)

Explanation

SOC dashboards are operational tools, not data lakes. The guiding principle is to maximize analyst decision speed and accuracy under time pressure. Prioritizing critical information and removing unnecessary details reduces cognitive overload and alert fatigue, which are major contributors to missed high-severity incidents. A well-designed SOC dashboard highlights high-signal items first: active high/critical incidents, alerts with confirmed impact, identity compromise indicators, lateral movement signals, and key environmental health metrics (ingestion gaps, sensor failures). It also supports triage by surfacing minimal but essential context: affected user/host, severity, time window, tactic/technique mapping, and recommended first action. “Include as much data as possible” often results in clutter that slows response and hides important signals. Restricting access to only network admins is not a design principle and can hinder collaboration. Using only historical data undermines real-time detection and containment, which is central to SOC operations. Effective dashboards follow “need-to-know for action”: show what enables a fast, correct response first, and provide drill-down for deeper analysis when needed.

No community discussion yet for this question.