Need help with Splunk query for MTTD and MTTT per SOC analyst

[splunker_ak]

On our SOC operations dashboard we can already see the overall MTTD (Mean Time to Detect) and MTTT (Mean Time to Triage/Respond) metrics.

What I need, however, is to break these down per SOC analyst — specifically, how much time each analyst takes from detection creation through to closure.

At the moment, I can capture the detection creation time, but I’m not able to find the timestamps for:

When the alert was assigned

When it moved to in‑progress

When it was closed

Without those, I can’t calculate the analyst‑level metrics. Has anyone built a query that can pull these status change times, or can point me to the right fields/logs that track assignment, in‑progress, and closure events?

Any guidance or sample queries would be greatly appreciated.

Thanks

[splunker_ak]

Dear Giuseppe,

Yes, I went through the default SOC Operations dashboard and referred to the SPL from there. I tried modifying it to calculate MTTT and MTTR for each SOC analyst to track their activities, but unfortunately the closure time field is showing up empty in every search.

--

Ashok Kumar

[gcusello · Accepted solution]

Hi @splunker_ak ,

did you try to see in the incident_updates_lookup lookup and find the time of each status of your incident?

Ciao.

Giuseppe

[splunker_ak]

Thanks Sir Gcusello, it worked 

[gcusello]

Hi @splunker_ak ,

have you already analyzed the "SOC Operations" Dashboar in Enterprise Security?

probably you can find an answer to your question in this dashboard.

Ciao.

Giuseppe