> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/dashboards/service-review-dashboard.md). # Service Review Dashboard The Service Review dashboard shows a full picture of how your organization and Expel are working together to keep your environment secure. Access it by going to **Dashboards > Service Review**.

## About the Dashboard See below for more more details about each part of the page.

"How are we working together?" panels

Image showing the how are we working together section at the top of the page.

* The `Time to remediate with Verify Actions` panel shows the mean time from alert arrival in Workbench to the first Remediation Action completed, for incidents that require verification with your organization. This metric allows you to see how responsive your organization is to our alerts. * The `Time to remediate without Verify Actions panel` shows the mean time from alert arrival in Workbench to the first remediation action completed, for incidents that *do not* require verification with your organization. This metric allows you to see how responsive Expel is after an alert happens, in cases where we are able to remediate the issue without notifying your organization first.

Download Reports

You can download four standard SOC operational reports as CSV files. A blank entry indicates no incident or remediation occurred during the reporting period. See the [Reports Reference](#reports-reference) for more information about how the data is calculated. {% hint style="info" %} These reports are currently available for all standard time ranges (last month, past 7 days, past 30 days, past 90 days, past 180 days). Custom time ranges are not yet supported. {% endhint %} * `Mean Time to X (MTTX) Reports` shows the mean time (in minutes) to detect, triage, decision, investigate, acknowledge, and respond based on alert severity (All Severities, Critical, High, Medium, Low, Tuning). Suppressed alerts are not included in this report. * `Top Detections by Volume` shows the top 10 detections by volume that were triggered during the reporting period, the number of alerts for each, and the most common close reason. The report also breaks down the alerts into those that were suppressed or benign, and offers a percentage for each (for example, if 200 alerts out of 2500 for a particular detection were suppressed, this would account for 8% of all alerts for that detection). * `Close Reason Breakdown` lists all close reasons during the reporting period, the count of alerts for each one, and each count's percentage of the total count. * `All Expel Alerts, Investigations, Incidents` lists all Alerts, Investigations, and Incidents that were closed during the reporting period. This information helps you manually validate the totals against other reports, or make your own calculations based on custom filters or groupings.

"Time to" panels

Image showing the three panels, which look like boxes.

These three panels offer more details about response times. You can use them to help monitor and/or improve your engagement with security questions or assigned actions. * The `Time to triage` panel shows the actual triage times for alerts. * The `Time to complete Verify Actions` panel shows the mean time it takes for your organization to respond to a Verify Action. * The `Time to complete Remediation Actions` shows the mean time it takes for your organization to complete an assigned Remediation Action.

How we think about Verify Actions

Image showing the verify actions information area.

This panel offers general information about Verify Actions and some tips for accelerating your remediations.

Automations and context

This panel shows you how your automations and context are performing over the specified time period.

Expel Alert count by time of day, UTC

Image showing alert count by time of day in a chart format.

This panel shows you a heat map of your Expel Alerts by time of day and day of week. You can use it to help your organization provide appropriate staffing when Expel Alerts are most common.

What has Expel been up to?

This panel shows you the detections that were added or updated for the specified time period.

## Reports Reference ### Scope and Limitations All data in the available SOC operational reports is only based on `Closed` alerts. **No Managed Phishing or Threat Hunting alerts are included in the data.** ### MTTX Formulas

Mean Time to (MTT*)	Definition	Formula
Detect	The time between when an event is created in your environment, and when an Expel Alert is created.	`time_to_detect_ms = expel_alert_created_at − first_detected_at`, converted to minutes (`/ 60000`), then averaged across alerts. If the raw difference is ever negative, it will null.
Triage	The time between Expel Alert creation and the first SOC analyst touch.	`time_to_touch_ms = first_touched_at − expel_alert_created_at`, ÷ 60000, averaged (`avg_time_to_touch`).
Decision	The time between Expel Alert creation and the analyst's first disposition decision.	`time_to_decision_ms = first_decision_at − expel_alert_created_at`, ÷ 60000, averaged (`avg_time_to_decision`).
Investigate	The time between Investigation creation and investigative work ending.	`time_to_investigate_ms = investigative_work_first_ends_at − inv_created_at`, ÷ 60000, averaged (`avg_time_to_investigate`).
Acknowledge	The time between the lead Alert's creation and an Incident being declared.	`time_to_acknowledge_ms = inv_first_moved_to_incident_at − lead_expel_alert_created_at`, ÷ 60000, averaged (`avg_time_to_acknowledge`).
Respond	The time between the lead Alert's creation and the first Remediation Action being created.	`time_to_respond_ms = first_remediation_created_at − lead_expel_alert_created_at`, ÷ 60000, averaged (`avg_time_to_respond`).
Verify	Time between when an assigned Verify Action is first acknowledged by you and when a response occurs.	`time_to_verify_by_customer_sec = GREATEST(first_acknowledged_at − first_customer_assigned_at, 0)` The formula floors at 0. If the raw difference is ever negative, it is corrected to 0.
Remediate	Time between when the lead Expel Alert is created and when the first recommended Remediation Action is completed.	`created_completed_all − lead_expel_alert_created_at` This is distinct from the `first_remediation_completed_at` field.

### Troubleshooting If you have trouble exporting any of the reports, or if you believe you have found inaccurate data, please [contact our Support team](/support/how-to-reach-us.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.expel.io/workbench-reference/dashboards/service-review-dashboard.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.