SOAR automation and SOC metrics: playbooks, MTTD, MTTR and wellbeing

What SOAR is

Security Orchestration, Automation and Response (SOAR) tools connect your SIEM, EDR, email system, firewalls and ticketing system through their APIs, then run playbooks: scripted workflows triggered by an alert. Orchestration means coordinating many tools; automation means doing steps without a human; response means taking action. Many SIEM and XDR platforms now include SOAR features, and standalone products exist too.

What to automate, and what not to

A sensible approach is to automate enrichment first, then low-risk actions such as blocking a known-bad URL at the proxy, and only later higher-impact steps with an approval button. Every playbook needs an owner, error handling and logging, because a broken automation can fail silently or, worse, block a legitimate business partner.

Measuring a SOC

• MTTD (mean time to detect): from when malicious activity starts to when the SOC knows about it. Often estimated after incidents.
• MTTA (mean time to acknowledge): from alert to an analyst picking it up.
• MTTR (mean time to respond or recover): from detection to containment or full recovery. Always define which one you mean.
• Alert volume and true positive rate: per rule and per source, to drive tuning.
• Coverage: share of assets sending logs, and ATT&CK techniques with tested detections.

Means can be skewed by one huge incident, so medians or percentiles often tell a truer story. Beware of perverse incentives: if analysts are judged only on closing alerts fast, they will close them fast, not well. Pair speed metrics with quality checks such as peer review of a sample of closed cases.

Analyst wellbeing is a security control

Alert fatigue happens when people see so many low-value alerts that they stop looking closely. Tired analysts miss real attacks. Shift work, constant pressure and stressful incidents add up to burnout and high staff turnover, which drains experience from the team.

• Track alerts per analyst per shift and treat sustained overload as a risk to fix.
• Use automation to remove dull, repetitive work rather than to cut staff.
• Rotate duties between triage, hunting, projects and training.
• Hold blameless reviews after incidents and make it normal to ask for help.

Tip: in interviews, explaining how you would reduce noise, not just respond faster, shows real SOC maturity.

Real-world example: automating phishing reports

The two-analyst SOC at a fictional housing association receives about 40 staff phishing reports a day. Each takes ten minutes by hand: extracting links, checking reputation, searching mailboxes. The team builds a SOAR playbook that does these steps automatically and presents the analyst with a summary and a "purge from all mailboxes" button. The analyst still makes the final decision. Over the next quarter they track mean time to respond for phishing reports and see it fall from hours to minutes. They also track how many reports each analyst handles per shift, and use the saved time for detection tuning instead of adding more alert queues, which keeps workload manageable.