What question did this study set out to answer?

The aim is to integrate formal decision-making processes into SOC operations to enhance efficiency and compliance.

March 13, 20260 citationsOpen Access

DecisionSecOps: A Decision-Driven Methodology for Security Operations Centers

Key Points

The aim is to integrate formal decision-making processes into SOC operations to enhance efficiency and compliance.
Developed a methodology incorporating six pillars for SOC operations
Implemented multiple MCDA scoring algorithms including TOPSIS and CoCoSo
Validated in a production environment processing 8,500 alerts daily
Used a technology stack that includes FastAPI, PostgreSQL, and Redis
Achieved a 69% reduction in Mean Time to Resolution (MTTR)
Decreased false positives by 66%
Increased daily alert processing capacity by 165% without additional staff

Abstract

We introduce DecisionSecOps, a methodology that embeds formal Multi-Criteria Decision Analysis (MCDA) into Security Operations Center (SOC) operational loops. The framework is structured around six pillars: Scoring Studio (configurable MCDA scoring profiles), Priority Engine (automated ranking via 5 MCDA methods), Decision Audit Trail (complete provenance for compliance), Playbook Intelligence (decision-aware automated response), Stakeholder Alignment (role-specific scoring profiles), and Feedback Loop (continuous evidence-based recalibration). DecisionSecOps supports TOPSIS, CoCoSo, AEGIS, Weighted Sum, and Shannon Entropy as interchangeable scoring algorithms. Production validation at Organization T (8,500 alerts/day, 20 analysts) shows 69% MTTR reduction, 66% false positive decrease, and 165% increase in daily alert processing without additional staff. Architecture: FastAPI + PostgreSQL + Redis + AEGIS SDK (~9,400 lines, 320 tests, zero dependencies).

Demander à l'IA

Bookmark

View Full Paper