Service Review Dashboard

The Service Review dashboard shows a full picture of how your organization and Expel are working together to keep your environment secure. Access it by going to Dashboards > Service Review.

About the Dashboard

See below for more more details about each part of the page.

"How are we working together?" panels

• The Time to remediate with Verify Actions panel shows the mean time from alert arrival in Workbench to the first Remediation Action completed, for incidents that require verification with your organization. This metric allows you to see how responsive your organization is to our alerts.

• The Time to remediate without Verify Actions panel shows the mean time from alert arrival in Workbench to the first remediation action completed, for incidents that do not require verification with your organization. This metric allows you to see how responsive Expel is after an alert happens, in cases where we are able to remediate the issue without notifying your organization first.

Download Reports

You can download four standard SOC operational reports as CSV files. A blank entry indicates no incident or remediation occurred during the reporting period. See the Reports Reference for more information about how the data is calculated.

These reports are currently available for all standard time ranges (last month, past 7 days, past 30 days, past 90 days, past 180 days). Custom time ranges are not yet supported.

• Mean Time to X (MTTX) Reports shows the mean time (in minutes) to detect, triage, decision, investigate, acknowledge, and respond based on alert severity (All Severities, Critical, High, Medium, Low, Tuning). Suppressed alerts are not included in this report.

• Top Detections by Volume shows the top 10 detections by volume that were triggered during the reporting period, the number of alerts for each, and the most common close reason. The report also breaks down the alerts into those that were suppressed or benign, and offers a percentage for each (for example, if 200 alerts out of 2500 for a particular detection were suppressed, this would account for 8% of all alerts for that detection).

• Close Reason Breakdown lists all close reasons during the reporting period, the count of alerts for each one, and each count's percentage of the total count.

• All Expel Alerts, Investigations, Incidents lists all Alerts, Investigations, and Incidents that were closed during the reporting period. This information helps you manually validate the totals against other reports, or make your own calculations based on custom filters or groupings.

"Time to" panels

These three panels offer more details about response times. You can use them to help monitor and/or improve your engagement with security questions or assigned actions.

• The Time to triage panel shows the actual triage times for alerts.

• The Time to complete Verify Actions panel shows the mean time it takes for your organization to respond to a Verify Action.

• The Time to complete Remediation Actions shows the mean time it takes for your organization to complete an assigned Remediation Action.

How we think about Verify Actions

This panel offers general information about Verify Actions and some tips for accelerating your remediations.

Automations and context

This panel shows you how your automations and context are performing over the specified time period.

Expel Alert count by time of day, UTC

This panel shows you a heat map of your Expel Alerts by time of day and day of week. You can use it to help your organization provide appropriate staffing when Expel Alerts are most common.

What has Expel been up to?

This panel shows you the detections that were added or updated for the specified time period.

Reports Reference

Scope and Limitations

All data in the available SOC operational reports is only based on Closed alerts. No Managed Phishing or Threat Hunting alerts are included in the data.

MTTX Formulas

Mean Time to (MTT*)	Definition	Formula
Detect	The time between when an event is created in your environment, and when an Expel Alert is created.	time_to_detect_ms = expel_alert_created_at − first_detected_at, converted to minutes (/ 60000), then averaged across alerts. If the raw difference is ever negative, it will null.
Triage	The time between Expel Alert creation and the first SOC analyst touch.	time_to_touch_ms = first_touched_at − expel_alert_created_at, ÷ 60000, averaged (avg_time_to_touch).
Decision	The time between Expel Alert creation and the analyst's first disposition decision.	time_to_decision_ms = first_decision_at − expel_alert_created_at, ÷ 60000, averaged (avg_time_to_decision).
Investigate	The time between Investigation creation and investigative work ending.	time_to_investigate_ms = investigative_work_first_ends_at − inv_created_at, ÷ 60000, averaged (avg_time_to_investigate).
Acknowledge	The time between the lead Alert's creation and an Incident being declared.	time_to_acknowledge_ms = inv_first_moved_to_incident_at − lead_expel_alert_created_at, ÷ 60000, averaged (avg_time_to_acknowledge).
Respond	The time between the lead Alert's creation and the first Remediation Action being created.	time_to_respond_ms = first_remediation_created_at − lead_expel_alert_created_at, ÷ 60000, averaged (avg_time_to_respond).
Verify	Time between when an assigned Verify Action is first acknowledged by you and when a response occurs.	time_to_verify_by_customer_sec = GREATEST(first_acknowledged_at − first_customer_assigned_at, 0) The formula floors at 0. If the raw difference is ever negative, it is corrected to 0.
Remediate	Time between when the lead Expel Alert is created and when the first recommended Remediation Action is completed.	created_completed_all − lead_expel_alert_created_at This is distinct from the first_remediation_completed_at field.

Troubleshooting

If you have trouble exporting any of the reports, or if you believe you have found inaccurate data, please contact our Support team.