Data Visualization
About 3% of the CIS-SIR exam — see all 7 domains.
Smallest domain, but easy points if you know the vocabulary.
Dashboards
SIR ships dashboards that surface operational and management KPIs: open incidents by state/severity, SLA attainment, mean time to respond/resolve, incidents by category, analyst workload, and trend lines. Dashboards are role-aware so managers and analysts see relevant views.
Performance Analytics (PA)
Performance Analytics provides time-series trending, scorecards, and KPIs beyond point-in-time reports. SIR ships PA content packs/solutions with predefined indicators (for example, incidents created/closed over time, SLA breach rate, MTTR trends). PA captures snapshots of data over time so you can see direction of travel, not just current state. Know the difference: Reports = point-in-time; Performance Analytics = trend over time via scheduled snapshots.
MITRE ATT&CK visualization
SIR/TI integrate with the MITRE ATT&CK framework. Analysts associate tactics and techniques with security incidents, and the product provides a MITRE ATT&CK heat map and navigator to visualize adversary behavior coverage and which techniques appear across incidents. Child incident techniques can roll up to a parent (relevant to MSIM). This is both a Data Visualization and Threat Intelligence topic: know that ATT&CK associations exist, that there is a heat map/navigator, and that it visualizes tactics/techniques.
Sample questions from this domain
Three of the 9 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of a SOC dashboard in Security Incident Response?
- A. To recalculate risk scores for open security incidents as their trends change over time
- B. To assign new security incidents to analysts according to the workload shown in widgets
- C. To provide at-a-glance visibility into security incident metrics, trends, and workload ✓
- D. To store the historical incident records that Performance Analytics uses to draw trends
Why: A SOC dashboard gives at-a-glance visibility into incident metrics, trends and workload to support decisions; the Security Incident Management dashboard, for example, tracks the volume, performance and progress of security incidents. Risk scores are calculated on the incident record when relevant fields change, not by a dashboard. Assignment is handled by the configured assignment logic, such as auto-assignment or Advanced Work Assignment, not by dashboard widgets. Performance Analytics keeps its indicator scores as collected snapshots; a dashboard only displays them.
Which two metrics are commonly visualized on a Security Incident Response dashboard? (Choose two)
- A. Number of open security incidents by priority ✓
- B. Mean time to respond or resolve ✓
- C. CIs failing CMDB Health completeness checks
- D. Average fulfillment time of hardware requests
- E. Knowledge article views by author
Why: Open security incidents by priority and mean time to respond or resolve are standard SOC dashboard measures; the CISO dashboard, for example, shows new security incidents by priority and average times to identify, contain and eradicate. CMDB Health completeness, hardware request fulfillment time and knowledge article views are real platform metrics, but they belong to CMDB, request fulfillment and knowledge management rather than Security Incident Response.
Which ServiceNow capability is typically used to build modern, interactive dashboards for visualizing SIR data?
- A. The report templates used to share an incident's status by email
- B. The risk score weights screen in the SIR Setup Assistant
- C. Security Operations email parsing with its field transforms
- D. Performance Analytics and/or platform dashboards with reports ✓
Why: Performance Analytics and platform dashboards built from reports are used to visualize SIR data interactively; the Security Incident Response Platform Analytics Solutions provide preconfigured dashboards, such as the CISO and Security Incident Management dashboards, that use Performance Analytics indicator data. SIR report templates produce status reports about an incident to share by email, not interactive dashboards. Risk score weights tune how the risk score is calculated. Email parsing creates Security Operations records from detection tool emails.