Data Visualization
About 3% of the CIS-SIR exam — see all 7 domains.
Smallest domain, but easy points if you know the vocabulary.
Dashboards
SIR ships dashboards that surface operational and management KPIs: open incidents by state/severity, SLA attainment, mean time to respond/resolve, incidents by category, analyst workload, and trend lines. Dashboards are role-aware so managers and analysts see relevant views.
Performance Analytics (PA)
Performance Analytics provides time-series trending, scorecards, and KPIs beyond point-in-time reports. SIR ships PA content packs/solutions with predefined indicators (for example, incidents created/closed over time, SLA breach rate, MTTR trends). PA captures snapshots of data over time so you can see direction of travel, not just current state. Know the difference: Reports = point-in-time; Performance Analytics = trend over time via scheduled snapshots.
MITRE ATT&CK visualization
SIR/TI integrate with the MITRE ATT&CK framework. Analysts associate tactics and techniques with security incidents, and the product provides a MITRE ATT&CK heat map and navigator to visualize adversary behavior coverage and which techniques appear across incidents. Child incident techniques can roll up to a parent (relevant to MSIM). This is both a Data Visualization and Threat Intelligence topic — know that ATT&CK associations exist, that there is a heat map/navigator, and that it visualizes tactics/techniques.
Sample questions from this domain
Three of the 9 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of a SOC dashboard in Security Incident Response?
- A. To parse inbound emails
- B. To store threat feeds
- C. To provide at-a-glance visibility into security incident metrics, trends, and workload ✓
- D. To rebuild the CMDB
Why: A SOC dashboard gives at-a-glance visibility into incident metrics, trends, and workload to support decision-making. It does not parse emails, rebuild the CMDB, or store threat feeds.
Which two metrics are commonly visualized on a Security Incident Response dashboard? (Choose two)
- A. Number of open security incidents by priority ✓
- B. Mean time to respond or resolve ✓
- C. Employee vacation balances
- D. Marketing email open rates
- E. The office floor plan
Why: Open incidents by priority and mean time to respond/resolve are common SOC dashboard metrics. Vacation balances, floor plans, and marketing rates are not SIR metrics.
Which ServiceNow capability is typically used to build modern, interactive dashboards for visualizing SIR data?
- A. The CMDB identification engine
- B. The inbound email action
- C. The risk calculator
- D. Performance Analytics and/or platform dashboards with reports ✓
Why: Performance Analytics and platform dashboards with reports are used to visualize SIR data interactively. Email actions, the risk calculator, and the CMDB engine do not build dashboards.