Performance metrics, part 3: Success stories

This blog post summarizes how a SOC used measurements and UX-driven changes to improve efficiency: (1) automatic routing of related alerts reduced duplicate add-to-investigation actions by ~12%, (2) automation of BEC reporting cut the final findings step by ~34% while improving quality, and (3) targeted automation of repetitive investigative steps (suspicious logins and file/process activity) reduced median investigation time for those classes (suspicious logins by ~75%) and covered ~95% of weekly triage work.