## Metrics and KPIs

How do we measure the SOC's performance?

### MTTD (Mean Time To Detect)
*   How long does the attacker stay hidden?
*   *Goal*: Minimize this. (World average is ~20 days. Goal is <1 hour).

### MTTR (Mean Time To Respond/Remediate)
*   Once detected, how fast do we fix it?
*   *Goal*: Minimize this.

### False Positive Rate
*   Are we burning out analysts with bad alerts?

### Dwell Time
*   Total time the adversary had access.

Good metrics drive budget. "Our MTTD dropped 50% since we bought Tool X."