QuestionQ75
Incident responseYou were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?
- A Create a multi-event detection rule to calculate the response metrics in the outcome section based on the entity graph. Create a dashboard based on these metrics.
- B Create a dashboard table widget that displays the average case handling times by analyst, case priority, and environment.
- C Create a playbook block that can be re-used in all alert playbooks to write timestamps in the case wall after each change to the case. Write a job to calculate the case metrics.
- D Use the playbooks' case stages to capture metrics for each stage change. Create a dashboard based on these metrics.
Community Discussion