date,alerts_received,alerts_triaged,true_positives,false_positives,incidents_opened,mttd_minutes,mttr_minutes
2026-02-14,187,182,23,159,2,142,385
2026-02-15,203,195,19,176,1,156,410
2026-02-16,145,140,12,128,1,138,365
2026-02-17,132,127,10,117,0,0,0
2026-02-18,198,190,21,169,2,149,392
2026-02-19,211,200,25,175,3,161,425
2026-02-20,224,210,28,182,2,155,415
2026-02-21,195,188,22,166,1,133,370
2026-02-22,167,160,15,145,1,145,355
2026-02-23,142,138,11,127,0,0,0
2026-02-24,138,135,9,126,0,0,0
2026-02-25,205,198,24,174,2,158,402
2026-02-26,218,205,27,178,3,162,430
2026-02-27,231,215,31,184,2,148,388
2026-02-28,209,200,26,174,2,152,395
2026-03-01,192,185,20,165,1,139,375
2026-03-02,158,152,14,138,1,141,360
2026-03-03,148,143,12,131,0,0,0
2026-03-04,212,198,26,172,2,165,445
2026-03-05,228,210,30,180,3,170,460
2026-03-06,245,220,35,185,4,178,485
2026-03-07,239,218,33,185,3,168,470
2026-03-08,215,200,27,173,2,160,440
2026-03-09,178,170,18,152,1,150,400
2026-03-10,165,158,15,143,1,155,410
2026-03-11,250,225,38,187,4,182,498
2026-03-12,262,230,42,188,5,190,520
2026-03-13,258,228,40,188,4,185,510
2026-03-14,270,235,45,190,5,195,535
2026-03-15,310,240,65,175,7,88,312

# ============================================================================
# SOC METRICS DATA — GLOBEX CORPORATION
# Period: 2026-02-14 through 2026-03-15 (30 days)
# Source: Splunk SOAR automated metric collection
# ============================================================================
#
# COLUMN DEFINITIONS:
#   date             - Calendar date (YYYY-MM-DD)
#   alerts_received  - Total alerts ingested by SIEM from all sources
#   alerts_triaged   - Alerts reviewed by an analyst (Tier 1+)
#   true_positives   - Alerts confirmed as genuine security events
#   false_positives  - Alerts confirmed as benign / not actionable
#   incidents_opened - Alerts escalated to formal incident tickets
#   mttd_minutes     - Mean Time to Detect (avg minutes from compromise
#                      to first alert). Value is 0 on days with no incidents.
#   mttr_minutes     - Mean Time to Respond (avg minutes from detection
#                      to containment). Value is 0 on days with no incidents.
#
# NOTES:
#   - Weekends (Sat/Sun) show reduced alert volume due to lower user activity
#   - The SOC operates 24/7 with reduced weekend staffing (2 analysts vs 5)
#   - A new Suricata rule set was deployed on 2026-03-04
#   - The March 15 spike corresponds to the capstone incident
#   - alerts_triaged < alerts_received indicates triage backlog
#
# ============================================================================
#
# STUDENT TASKS:
#
# 1. TREND ANALYSIS
#    - Calculate the average daily alert volume for weeks 1-2 vs weeks 3-4
#    - Is the alert volume increasing? What might explain the trend?
#    - Calculate the triage backlog (alerts_received - alerts_triaged) trend
#    - On which days was the backlog worst? What are the staffing implications?
#
# 2. FALSE POSITIVE ANALYSIS
#    - Calculate the daily false positive rate (false_positives / alerts_triaged)
#    - What is the 30-day average FP rate?
#    - Is the FP rate improving or worsening after the March 4 rule deployment?
#    - Estimate how many analyst-hours per day are spent on false positives
#      (assume 8 minutes average triage time per alert)
#
# 3. MTTD / MTTR ANALYSIS
#    - Calculate average MTTD and MTTR for the full 30-day period
#      (exclude zero-incident days)
#    - Is MTTD trending up or down? What does this mean for the SOC?
#    - Is MTTR trending up or down? What contributing factors might explain this?
#    - On March 15, MTTD dropped to 88 min — why? (Hint: check the alert feed)
#    - On March 15, MTTR dropped to 312 min — is this actually good?
#
# 4. IMPROVEMENT RECOMMENDATIONS
#    - Identify the top 3 metrics that need improvement
#    - For each metric, propose a specific, actionable improvement plan
#    - Estimate the expected metric improvement if your plan is implemented
#    - Create a 30/60/90 day roadmap for SOC improvement
#    - What additional metrics should the SOC start tracking?
#
# 5. EXECUTIVE SUMMARY
#    - Write a 1-page executive summary of SOC performance for the past month
#    - Include 3 key findings, 3 risks, and 3 recommendations
#    - Present the data visually (describe charts/graphs you would create)
#
# ============================================================================