Skip to content
Get packs

Guide · Agent skill

How to use the SOC Metrics and KPI Tracking agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The SOC Metrics and KPI Tracking skill teaches an AI agent how to measure how well a security operations center performs. Once installed, the agent can work through metrics such as mean time to detect and respond, alert true and false positive rates, analyst workload by shift, and ATT&CK detection coverage, using Splunk data. This guide explains what the skill does, how to install it, how to ask for it, and what you need before it will return useful numbers.

SOC Metrics and KPI Trackingmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Get the skill files. Download the skill ZIP from the page where you found this guide. Keep the folder structure intact so scripts/agent.py and references/api-reference.md stay alongside SKILL.md.
  2. 2Install it. Unzip into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Confirm your SIEM data. Check that Splunk holds notable and incident data going back at least 90 days, and that ticketing timestamps are available.
  4. 4Set Splunk credentials. Provide the Splunk URL, username and password, using the environment variables that scripts/agent.py reads.
  5. 5Ask for a metric. Request a specific measure and time window in plain language, for example MTTD for the last 30 days by urgency.
  6. 6Review and adjust. Check the numbers against your own data and targets before sharing them, since the skill's thresholds are suggestions.

What the skill makes the agent do

The skill is a set of instructions and helper files that an AI agent loads when your request matches its purpose. Its stated goal is to build SOC performance metrics and KPI tracking dashboards using SIEM data, for operational visibility, continuous improvement and executive reporting.

The workflow in the skill covers six areas: a core metrics framework, MTTD and MTTR measurement, alert quality and analyst productivity, detection coverage, executive reporting, and continuous improvement tracking. For each metric it suggests a target, for example MTTD under 15 minutes, false positive rate under 30 percent and ATT&CK coverage above 60 percent. These targets are the skill's suggestions and should be adjusted to your organisation.

  • MTTD: time from threat occurrence to SOC detection
  • MTTA, MTTI and MTTC: acknowledgment, investigation start and containment times
  • MTTR: time from detection to full resolution
  • FP and TP rates, and a signal-to-noise ratio
  • Analyst productivity and shift-based workload
  • ATT&CK technique coverage and data source coverage

Install the skill (ZIP download or Claude apps)

Download the skill ZIP from the page where you found this guide. The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md.

For Claude Code, unzip the folder into your personal skills directory ~/.claude/skills/ or into a project's .claude/skills/ directory so it applies only to that project.

In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

Set up your data and credentials

The skill needs real data before it produces anything meaningful. Its prerequisites are a SIEM with 90 or more days of incident and alert disposition data, an incident ticketing system such as ServiceNow or Jira that provides timestamps, analyst shift schedules, ATT&CK Navigator for coverage tracking, and a dashboard platform such as Splunk, Grafana or Power BI.

The Python helper needs Python 3 and the requests library. It logs into Splunk's REST API using a username, password and Splunk URL. The requirements say these are set through environment variables; check scripts/agent.py for the exact variable names it reads.

  • Splunk SIEM with notable/incident data, ideally 90+ days
  • Python 3 with the requests library
  • Splunk username, password and URL
  • Ticketing timestamps from ServiceNow or Jira
  • A dashboard tool such as Splunk, Grafana or Power BI

Run the Splunk metrics helper

The helper script connects to Splunk, authenticates and runs searches to collect the metrics, then writes a consolidated report. The reference lists the arguments below. --splunk-url defaults to https://localhost:8089, --username defaults to admin, --password is required, and --output defaults to soc_metrics_report.json.

Passing the password on the command line can leave it in your shell history, so prefer the environment-variable approach where you can.

  • --splunk-url: Splunk management URL (default https://localhost:8089)
  • --username: Splunk username (default admin)
  • --password: required
  • --output: output file path (default soc_metrics_report.json)
python agent.py --splunk-url https://splunk:8089 --username admin --password <pass> --output report.json

Ask for the skill with natural requests

You do not need a special command. Describe the reporting need in plain language and the agent should pick up the skill. The skill's trigger guidance is written around leadership needs such as operational visibility, continuous improvement tracking, and executive reporting on security operations effectiveness.

Be specific about the metric and the time window. Good requests name the measure, the period and the output you want, so the agent knows which of the skill's searches to adapt.

  • Calculate our MTTD and MTTR for the last 30 days, split by urgency.
  • Show the false positive and true positive rate for notable alerts this month.
  • Build a weekly MTTD/MTTR trend over the last 90 days.
  • Which shifts carry the most alerts per analyst?
  • How much of the ATT&CK matrix do our detections cover, by tactic?

What people use it for

  • A SOC manager gets a 30-day baseline of MTTD and MTTR by urgency level to guide process changes.
  • A security engineer builds a weekly Splunk trend dashboard of alert quality for leadership.
  • A team reviews alert workload by shift to inform staffing decisions, without ranking individuals.
  • A compliance team gathers documented evidence of detection coverage across ATT&CK tactics.

Frequently asked questions

Is the SOC Metrics and KPI Tracking skill free to use?

The skill is published under the Apache-2.0 licence, which you should read for its own terms. The skill itself needs Splunk, and the source does not cover Splunk licensing or costs, so check those separately.

What do I need to run this skill?

You need a Splunk SIEM with 90 or more days of incident and alert data, Python 3 with the requests library, Splunk credentials and URL set via environment variables, and ticketing timestamps from ServiceNow or Jira. A dashboard tool such as Splunk, Grafana or Power BI is also listed.

Does the skill work without Splunk?

The source describes its queries and helper script as Splunk-based. It is not designed for environments without a SIEM holding 90+ days of alert and incident data, because the queries will return little or nothing useful.

Why does my report show empty or odd numbers?

The most likely causes are too little historical data, missing timestamps, or alerts without resolved status labels. The skill's queries filter out durations outside expected ranges, so check your data sources and the time window you requested.

Can I use this to rank analysts?

The skill warns against it. It says metrics should drive process improvement, not individual performance management, and it is not meant for punitive use.

How is this different from other SOC metrics tools?

The source does not compare it with other tools. Its distinguishing features are the ready-made Splunk searches for MTTD, MTTR, alert quality, shift workload and ATT&CK coverage, plus a Python helper that pulls the data from Splunk.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits SOC managers and Splunk engineers who want a documented starting point for performance metrics and trend reports, and who have enough historical SIEM data. Skip it if you have no SIEM with 90+ days of alert data, if you plan to use metrics to judge individual analysts, or if your organisation will not allow scripts to log into the SIEM with stored credentials.

Download the skill