Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Incidents and response

Manage your SOC Better with Incident Metrics in Microsoft Sentinel

4 September 2026Doc update+23 / −20 lines

In brief

The article title and section headings were revised, metadata was refreshed, and related-content links were updated and reworded.

What Defender admins need to know

Administrators will find clearer navigation to Sentinel onboarding and visibility guidance; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Manage yourUse incident metrics in Microsoft Sentinel to measure SOC better with incident metricsperformance

[!INCLUDE reference-to-feature-availability]

As a Security Operations Center (SOC) manager, you need to have overall efficiency metrics and measures at your fingertips to gauge the performance of your team. You'll want to see incident operations over time by many different criteria, like severity, MITRE tactics, mean time to triage, mean time to resolve, and more. Microsoft Sentinel now makes this data available to you with the new SecurityIncident table and schema in Log Analytics and the accompanying Security operations efficiency workbook. You'll be able to visualize your team's performance over time and use this insightthese incident metrics to improve efficiency. You can also write and use your own KQL queries against the incident table to create customized workbooks that fit your specific auditing needs and KPIs.

Use the security incidents table

:::image type="content" source="./media/manage-soc-with-incident-metrics/security-incident-table.png" alt-text="Security incidents table":::

Every time you create or update an incident, a new log entry will be added to the table. This allows you to track the changes made to incidents, and allows for even more powerful SOC metrics, but you need to be mindful that each incident update creates a new log entry when constructing queries for this table, as you may need to remove duplicate entries for an incident (dependent on the exact query you are running).

For example, if you wanted to return a list of all incidents sorted by their incident number but only wanted to return the most recent log per incident, you could do thisretrieve the most recent log per incident by using the KQL summarize operator with the arg_max() aggregation function: 

SecurityIncident
| summarize arg_max(LastModifiedTime, *) by IncidentNumber

Sample KQL queries for incident metrics

Security operations efficiency workbook

To complement the SecurityIncidents table, we’ve provided you with an out-of-the-box security operations efficiency workbook template that you can use to monitor your SOC operations. The workbook contains the following metrics:

  • Incident created over time
  • Incidents created by closing classification, severity, owner, and status
  • Mean time to triage
  • Mean time to closure
  • Incidents created by severity, owner, status, product, and tactics over time
  • Time to triage percentiles
  • Time to closure percentiles
  • Mean time to triage per owner
  • Recent activities
  • Recent closing classifications

You can find this new workbook template by choosing Workbooks from the Microsoft Sentinel navigation menu and selecting the Templates tab. Choose Security operations efficiency from the gallery and click one of the View saved workbook and View template buttons.

[!INCLUDE SecurityIncidents schema]

Next stepsRelated content