Microsoft Sentinelの要件を満たすために、どの平均時間メトリックを使用するかを特定する必要があります。どのワークブックを使用すればよいでしょうか?
正解:B
Microsoft Sentinel provides built-in workbooks for oper ational insights. To analyze mean time metrics (Mean Time to Acknowledge, Mean Time to Resolve, Mean Time to Mitigate), the correct workbook is Security Operations Efficiency .
According to Microsoft's Sentinel documentation:
"The Security Operations Effici ency workbook helps SOC teams monitor and improve operational performance by showing incident trends and key performance indicators such as mean time to acknowledge (MTTA), mean time to resolve (MTTR), and incident closure rates." Other options:
* Analytics Efficiency - tracks analytic rule performance.
* Event Analyzer - provides event data analysis, not MTTA/MTTR.
* Investigation Insights - focuses on incident investigation details, not SOC metrics.
# Correct workbook: Security Operations Efficiency