Thread by @jhencinski

A #SOC analyst picks up an alert and decides not to work it.

In queuing theory, this is called “work rejection”–and it’s quite common in a SOC.

TL;DR - “Work rejection” is not always bad, but it can be measured and the data can help improve performance. More details in the 🧵..

A couple of work rejection plays out in the SOC. The most common:

An analyst picks up an alert that detects a *ton* of benign activity. Around the same time, an alert enters the queue that almost *always* finds evil. A decision is made...

The analyst rejects the alert that is likely benign for an alert that is more likely to find evil.

Let’s assume the analyst made the right call. They rejected an alert that was likely benign to work an alert that was evil. Work rejection resulted in effective #SOC performance.

Another common scenario:

An analyst picks up an alert and doesn’t know what the alert means or what to do. Perhaps the alert doesn’t contain enough evidence of decision support. A decision is made...

The analyst “rejects the work” and moves on to the next alert hoping the alert conditions are more favorable (e.g, “I can handle the *next* one”).

By looking at the patterns and trends of “work rejection” in the SOC you can spot ways to improve performance.

One way we do this @ExpelSecurity is for every alert sent to the SOC we record how many analysts picked up the alert before a decision is made. This allows us to determine how often the alert, aka the “work”, is rejected before completion.

There are two main benefits:

1. The first benefit is you’ll see which classes of alerts newer analysts “reject” most often. Armed with this context you can modify training material or deploy more decision support to improve performance and reduce work rejection.

2. The second benefit is you'll see which classes of alerts are “rejected” by everyone. Armed with this context you can make adjustments to reduce work rejection (demote severity, add evidence/enrichment/orchestration).

Recap:
- “Work rejection” in a SOC isn’t always bad. There are cases where rejecting one alert for another results in effective SOC performance.
- “Work rejection” can be measured and the data can help shine a light on areas where you can improve performance.

Recap (cont'd):
- Remember, “work rejection” happens before the triage decision. So, an alert with a high benign rate + a high “work rejection” rate is likely ripe for optimization.
- “Work rejection” rates help you understand where analysts are confused or need a bit more help