What metrics are reported. Include things MTTD (how long between when an event actually started and when it was worked by the SOC), MTTR (how long between when a event was worked and when it resolved). Also include metrics for each team SLA. What percentage of items met the SLAs, call out any abnormal condition, such as if you had to wait for external services or outages to be resolved. This does not have to be the report itself but should determine what is on the report. Recommend that this be formatted as an initial description of some sentences and then a bullet list describing each metric term and brief definition. Use the tables above for ideas on possible metric. Metric 1 - Description Metric 2 - Description Metric 3 - Description https://www.sirp.io/blog/understanding-the-key-performance-indicators-kpis-of-security-operations-center-soc/