What's changed: Created Professional Security Operations Engineer Chapter 6 (Domain 6 "Observability": key security analytics (metrics/KPIs=MTTD-MTTR/trends), dashboards (Google SecOps SOAR/SIEM/Data Studio), report generation/customization; health-monitoring metrics, centralized dashboards, threshold alerts, Cloud Monitoring notifications, identifying health issues with Cloud Logging, silent source detection).
6.1Dashboards and reports
Understand identifying key security analytics (metrics, KPIs, trends), implementing dashboards to visualize security telemetry, ingestion metrics, detections, alerts, and IOCs (Google SecOps SOAR, SIEM, Data Studio), and generating/customizing reports.
Observability makes the SOC's state and outcomes visible. Measure operations with metrics, and communicate via dashboards and reports.
6.1.1Security analytics and dashboards
First identify key security analytics: metrics (detections, alerts, false-positive rate), KPIs (MTTD—mean time to detect, MTTR—mean time to respond, case-resolution rate), and trends (rising/falling attacks, top threats). Visualize them in dashboards: security telemetry, ingestion metrics (log volume/cost), detections, alerts, and IOCs—via built-in Google SecOps SOAR/SIEM dashboards or flexible Data Studio. For executives/stakeholders, generate and customize reports to communicate SOC outcomes and trends. Map "measure operational health = KPIs like MTTD/MTTR" and "flexible visualization/reporting = Data Studio."
Common: requirement → means. E.g., "measure detection/response speed" = KPIs like MTTD/MTTR; "visualize detections/alerts/IOCs/ingestion volume" = Google SecOps SOAR/SIEM dashboards; "flexible-layout visualization/reporting for executives" = Data Studio; "report SOC outcomes/trends to stakeholders" = generating/customizing reports.
Watch the mix-ups: (1) Distinguish metrics (raw numbers) vs KPIs (key indicators against goals)—KPIs are to "measure and improve." (2) Choose built-in dashboards (SecOps) vs Data Studio (flexible BI) by use. (3) Dashboards are not just "to show" but to measure for operational improvement.
6.1.2Section summary
- Key analytics = identify metrics/KPIs (MTTD/MTTR)/trends
- Visualize = Google SecOps SOAR/SIEM dashboards; flexible = Data Studio
- Generate/customize reports to communicate SOC outcomes/trends to stakeholders
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To measure SOC operational quality, you track mean time to detect (MTTD) and respond (MTTR). What are these?
Q2. To visualize detections, alerts, IOCs, and ingestion metrics on one screen, which is best?
Q3. To visualize security metrics with a flexible layout and build reports for executives, which is best?
Q4. Which correctly distinguishes metrics from KPIs?
Q5. What is the best purpose of building dashboards?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.