0101
0202
0303
0404
0505
0606
Review each statement. Click once for yes, twice for no. Click a marked statement again to clear it.
Assessment Pillar 1
Alert Signal Strength
Alerts from multiple tools are consolidated into unified incidents. Detection logic reduces duplicate or overlapping notifications. Low-confidence alerts are filtered or deprioritized automatically. Detection thresholds are reviewed and tuned regularly. Analysts receive incidents, not isolated raw events. If your team spends time stitching alerts together manually, signal quality is low.
Assessment Pillar 2
Network Visibility & Threat Exposure
Traffic inspection goes beyond basic metadata collection. Encrypted sessions are analyzed with meaningful visibility. East-west activity is monitored for suspicious movement. Embedded or compressed content within traffic is inspected. Asset communication patterns are continuously evaluated for anomalies. When network visibility is shallow, false positives increase, and real threats blend in.
Assessment Pillar 3
Context & Investigative Depth
Each alert includes device, user, and asset context. Threat activity is automatically aligned to known adversary behaviors. Analysts can review full activity timelines within one interface. Historical behavior is used to validate anomalies before escalation. Alerts reflect business risk, not just technical severity. Context transforms noise into actionable intelligence.
Assessment Pillar 4
Automation & Operational Efficiency
Routine triage tasks are automated. Initial alert enrichment happens before analyst review. Suspicious files or behaviors are analyzed automatically. Detection models adapt based on environmental changes. High-confidence triggers require minimal manual validation. If analysts repeat the same investigative steps daily, automation maturity is limited.
Assessment Pillar 5
Platform Integration & Signal Correlation
Network, endpoint, cloud, and identity telemetry are correlated. Your security tools share intelligence without manual intervention. Duplicate alerts across systems are automatically reconciled. Risk posture is centralized into a unified operational view. Your existing stack operates cohesively rather than independently. Fragmented tools create fragmented signals.
Assessment Pillar 6
SOC Health & Performance Indicators
Alert backlogs are stable and manageable. Response times are consistent or improving. Escalations are meaningful and accurate. Analysts are not routinely dismissing alerts due to volume pressure. Staff retention and morale remain steady. Fatigue often appears first in performance metrics.
Mark at least one statement in this pillar to continue.
