SOC Metrics and KPI Tracking
Builds SOC performance dashboards tracking MTTD, MTTR, alert quality and detection coverage from SIEM data.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent how to measure how well a security operations center (SOC) performs. Once installed, the agent can define key metrics such as how long threats take to detect and resolve, false-positive and true-positive alert rates, analyst workload by shift, and how much of the MITRE ATT&CK technique list is covered by detections. It supplies ready-made Splunk search queries for these measures and a Python helper that logs into Splunk and runs searches to pull the data.
Great for
- SOC managers who need baseline performance numbers and trend reports
- Security engineers building Splunk-based dashboards for leadership
- Teams preparing compliance evidence of security operations performance
Skip it if
- Using the metrics to rank or punish individual analysts, which the skill itself warns against because it undermines process improvement
- Environments without a SIEM holding 90+ days of alert and incident data, since the queries will return little or nothing useful
- Organisations that cannot allow scripts to log into their SIEM with stored credentials
Try asking
- “Create a monthly SOC executive summary with MTTD, MTTR and false-positive rate trends”
- “Write Splunk searches to calculate alert true-positive and false-positive rates over the last 30 days”
- “Map our detection rules to MITRE ATT&CK and report coverage by tactic”
- “Design a shift-based workload report showing alerts per analyst”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-soc-metrics-and-kpi-tracking.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-soc-metrics-and-kpi-tracking.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-soc-metrics-and-kpi-tracking.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py before running it, and point SPLUNK_URL at a test instance first.
- Avoid setting SKIP_TLS_VERIFY=true outside lab environments, since it disables certificate checks for the Splunk connection.
- Agree with analysts up front that metrics are for process improvement, not individual performance reviews.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.