A transit SOC scoreboard ranks analysts by tickets closed per hour, and dispositions are being rubber-stamped. What should analysts help the city define instead?
Select an answer to reveal the explanation.
Short Explanation
Tickets closed per hour is a pizza-oven metric: it rewards sliding pies out whether they are cooked. Analysts should help pick clocks that measure detection, response, dwell, and honest dispositions. Rubber stamps empty the queue and poison the lesson.
Full Explanation
Official Splunk learning-path guidance is that analysts help define which SOC metrics matter. Raw close-rate incentivizes rubber-stamped dispositions and Resolved or Closed statuses without analysis. Quality-aware measures—accurate dispositions, MTTD, MTTR, and dwell—better reflect cyber-defense outcomes. Unowned Closed notables and higher close-rate targets amplify the perverse incentive rather than fix it.