Template: SOC Dashboard

Template Instructions

Overall Layout and Design:

1. Main Sections:

• Divide the slide into three main sections: "Detect & Respond", "Quarterly Trends", and "Risk Management".
• Relevance: Segmenting the dashboard into these areas allows viewers to quickly locate information relevant to different aspects of security operations.

Section 1: Detect & Respond

Purpose: To provide a quick snapshot of the operational status and effectiveness of the security alerting and response processes.

1. Alerts & Events:

• Show totals for "Alerts Reviewed" and "Threats Triaged" with bold figures to draw attention.
• Relevance: Highlighting these numbers gives an immediate sense of the volume of security events being handled.

2. Alert Breakdown:

• Include a small table categorizing alerts by type to give a detailed view of alert distribution.
• Relevance: This helps in quickly identifying which types of alerts are most frequent and may require additional resources.

3. Metrics (MTTD, MTTR, MRT):

• Present these key performance indicators to provide insights into the efficiency of the security response.
• Relevance: Metrics like Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Mean Time to Recovery (MRT) are crucial for assessing the performance of the SOC.

Section 2: Quarterly Trends

Purpose: To give an overview of the security posture over time and financial commitment to information security.

1. NIST CSF Maturity Score:

• Display the current maturity score and compare it to industry standards.
• Relevance: This score helps in benchmarking the organization against best practices and industry averages.

2. Quarterly InfoSec Spend:

• Show the budget allocated/spent on information security for the quarter.
• Relevance: It's important for tracking investment in security and for correlating spend with outcomes.

Section 3: Risk Management

Purpose: To highlight potential and existing risks to the organization's assets and operations.

1. Threat Vectors:

• List current threat vectors with reasons they are considered a risk.
• Relevance: Understanding 'why' behind each threat vector helps in prioritizing security measures.

2. Critical Areas:

• Identify and display critical assets at risk.
• Relevance: It allows the SOC team to focus their efforts on protecting key areas of the business.

Section 4: Assets (Footer)

Purpose: To summarize the scope of assets being protected.

1. ID Users, Endpoints, Virtual Machines, App Services:

• Present an at-a-glance view of the number of various types of assets.
• Relevance: Provides context for the scale of the SOC's responsibility and potential exposure.

Footer:

Data Timing:

• Include a timestamp for the data provided, adding context to the metrics.
• Relevance: Data currency is vital for understanding if the dashboard is reflecting the current state of affairs or if it’s outdated.

---