Incident Detection and Triage · Topic 6 of 6
SOC Dashboards, Visualization and Reports
Learn SOC dashboard types, the charts and KPIs such as MTTD and MTTR they show, and the operational, executive and compliance reports for CSA 312-39.
- 4 min
- Match the dashboard to its audience: operational for analysts, executive for leadership.
- MTTD measures detection speed; MTTR measures response or resolution speed; lower is better for both.
- Line charts show trends, bar charts compare categories, heat maps show unusual times.
What it is
A dashboard is a live, visual summary of SOC data: alert queues, trends, top sources and key metrics. Dashboard management means designing dashboards for each audience, keeping them accurate, and removing panels nobody uses.
A SOC report is a fixed record for a period or an event. Reports tell managers, executives, auditors and other teams what happened, how the SOC performed and what needs to change.
How it works
Dashboard types by audience
| Dashboard | Audience | Typical content |
|---|---|---|
| Operational | Tier I and Tier II analysts | Open alerts by severity, queue age, current incidents, source health |
| Tactical or analytical | SOC leads, threat hunters | Trends, top attacked hosts, top source addresses, ATT&CK coverage |
| Strategic or executive | CISO, senior management | Risk posture, incident counts over time, KPIs, compliance status |
| Compliance | Auditors, governance teams | Status of required controls and log retention |
Choosing the right visualization
| Visualization | Best for |
|---|---|
| Line chart over time | Trends, such as alerts per day or failed logons per hour |
| Bar chart | Comparing categories, such as top 10 source addresses |
| Pie or donut | Share of a whole, used sparingly, such as alerts by severity |
| Geographic map | Source locations of connections |
| Heat map | Activity by hour and day, revealing unusual times |
| Single number tile | A KPI such as open critical incidents |
| Table | Details analysts can act on |
Good dashboards answer a clear question, use consistent time ranges, highlight what needs action, and load quickly. Too many panels hide what matters.
Key SOC metrics shown on dashboards
| KPI | Meaning |
|---|---|
| MTTD (mean time to detect) | Average time from the start of an attack to its detection |
| MTTA (mean time to acknowledge) | Average time from alert to an analyst picking it up |
| MTTR (mean time to respond, or to resolve) | Average time from detection to containment or resolution |
| False positive rate | Share of alerts that turn out benign |
| Alerts per analyst per shift | Workload and fatigue risk |
| Incidents by category and severity | What threats the organization faces |
| Escalation rate | Share of Tier I alerts escalated to Tier II |
| Log source coverage | Share of critical assets sending logs |
Lower MTTD and MTTR mean attackers have less time inside. A falling false positive rate shows tuning is working.
Types of SOC report
| Report | Content | Audience |
|---|---|---|
| Shift or daily report | Alerts handled, open items, handover notes | Next shift, SOC lead |
| Incident report | Timeline, scope, impact, root cause, actions, lessons learned | Management, IR team, legal if needed |
| Weekly or monthly operational report | Alert volumes, KPIs, tuning done, top threats | SOC manager |
| Executive report | Business risk, trends, major incidents, resourcing needs, in plain language | CISO, board |
| Compliance report | Evidence of monitoring and retention for standards such as PCI DSS, HIPAA or ISO/IEC 27001 | Auditors |
| Threat intelligence report | Threats relevant to the organization and recommended actions | SOC, IT, management |
| Vulnerability report | Exposed weaknesses seen in scans and alerts | IT and asset owners |
A good incident report states facts with timestamps, separates confirmed findings from assumptions, and ends with recommendations that have owners.
A worked example
The CISO asks for a monthly update. The SOC lead does not send the analyst queue dashboard. Instead she sends an executive report: incident count by category compared with last month, MTTD and MTTR trends, one paragraph on the most serious incident and its business impact, and a request for budget to add cloud log sources that currently create a blind spot.
The operational detail stays on the analyst dashboard, where it is useful.
How the exam asks about this
- "Which metric measures the average time from an attack starting to the SOC detecting it?" → MTTD.
- "Which report should include a timeline, root cause and lessons learned?" → The incident report.
- "Which dashboard is designed for senior management?" → The strategic or executive dashboard.
What to remember for the exam
- Match the dashboard to its audience: operational for analysts, executive for leadership.
- MTTD measures detection speed; MTTR measures response or resolution speed; lower is better for both.
- Line charts show trends, bar charts compare categories, heat maps show unusual times.
- Incident reports contain timeline, scope, impact, root cause, actions and lessons learned.
- Executive reports use business language, trends and risk, not raw logs.
A dashboard full of panels that nobody acts on is noise. Review dashboards regularly and remove or fix panels that do not drive a decision.
Common mistakes
Sending technical detail to executives. Leadership needs impact, trend and decisions needed, not lists of addresses.
Measuring only volume. Counting alerts says little. Pair volume with MTTD, MTTR and false positive rate to show effectiveness.
Mixing up MTTD and MTTR. Detect comes first; respond or resolve comes after detection.
Check yourself
What does a falling MTTR show?
The SOC is containing or resolving incidents faster after detection.
Which visualization best reveals activity at unusual hours?
A heat map of activity by hour and day.
What separates a dashboard from a report?
A dashboard is a live, visual view for monitoring, while a report is a fixed summary for a period or an event.
Topic 6 of 6 in Incident Detection and Triage
Test yourself on Incident Detection and Triage
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.