On our SOC operations dashboard we can already see the overall MTTD (Mean Time to Detect) and MTTT (Mean Time to Triage/Respond) metrics. What I need, however, is to break these down per SOC analyst — specifically, how much time each analyst takes from detection creation through to closure. At the moment, I can capture the detection creation time, but I’m not able to find the timestamps for: When the alert was assigned When it moved to in‑progress When it was closed Without those, I can’t calculate the analyst‑level metrics. Has anyone built a query that can pull these status change times, or can point me to the right fields/logs that track assignment, in‑progress, and closure events? Any guidance or sample queries would be greatly appreciated. Thanks ... View more