PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #109
You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the…
The correct answer is B. Create a dashboard table widget that displays the average case handling times by analyst, case. The most direct approach is to create a dashboard table widget that displays average case handling times by analyst, case priority, and environment. This gives you a clear view of MTTR and other relevant metrics without additional playbook or rule development, making it easy to…
Question
You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?
Options
- ACreate a multi-event detection rule to calculate the response metrics in the outcome section
- BCreate a dashboard table widget that displays the average case handling times by analyst, case
- CCreate a playbook block that can be re-used in all alert playbooks to write timestamps in the case
- DUse the playbooks' case stages to capture metrics for each stage change. Create a dashboard
How the community answered
(28 responses)- A7% (2)
- B71% (20)
- C18% (5)
- D4% (1)
Explanation
The most direct approach is to create a dashboard table widget that displays average case handling times by analyst, case priority, and environment. This gives you a clear view of MTTR and other relevant metrics without additional playbook or rule development, making it easy to understand your SOC's current performance.
Topics
Community Discussion
No community discussion yet for this question.