Incident quality and detection strength: what do SOC teams do now?

TL;DR: A method for scoring incident quality combines detection diversity, capped alert counts, and dominance ratio, according to Expel. The approach helps SOC teams measure resilience, track improvement over time, and tune detections toward clearer coverage, arguing that stronger incidents are those least likely to be missed if one detection fails.

NHIMG editorial — based on content published by Expel: how to measure incident quality and detection strength

Questions worth separating out

Q: What breaks when an incident relies on only one detection source?

A: The incident becomes fragile because a single broken rule, disabled sensor, or noisy data path can remove the only evidence supporting triage.

Q: Why do repeated alerts not always mean better detection quality?

A: Repeated alerts can simply mean one rule is firing many times, not that the incident is well covered.

Q: How can security teams tell whether incident readiness is actually improving?

A: Look for shorter containment times, fewer repeat interventions from the same weakness class, and clearer ownership for revoke and isolation actions.

Practitioner guidance

• Score incidents for corroboration, not just alert totals Add an incident-quality metric that weights unique detections, repeated evidence, and dependence on the loudest source so fragile patterns are easy to spot.
• Track dominance in your highest-volume detections Identify rules where one telemetry source accounts for most of the incident evidence, then test what disappears when that source is suppressed.
• Separate critical one-alert incidents from weakly supported noise Allow for true early-stage incidents that naturally have fewer signals, but do not let low-volume alerts mask poor coverage elsewhere.

What's in the full article

Expel's full article covers the mathematical detail this post intentionally leaves at the analytical level:

• The exact Shannon and Hill Number calculations used to compare incident detection diversity.
• The capped-count method for weighting repeated detections without letting one source dominate the score.
• The dominance-ratio equation and how it separates noisy incidents from robust ones.
• The quarterly stacked-bar approach for tracking whether incident quality is improving over time.

👉 Read Expel's analysis of how to measure incident quality and detection strength →

Incident quality and detection strength: what do SOC teams do now?

Explore further

View Full Forum →  |  NHI Foundation Course →