Report & Roster
The SOC's numbers — volumes, dispositions, true-positive rate and time to resolve — over 7, 30 or 90 days, plus the analyst roster with presence, on-call status and workload.
The report
/soc/report opens on the last 30 days (7d and 90d buttons switch the period) with four figures: Total cases (and how many are still open), Resolved (with close rate), True positive rate across dispositioned cases, and Avg. time to resolve across resolved cases. Below them: cases opened per day, disposition and severity breakdowns, the alert-source split, alert-origin and IOC-sighting world maps, a per-workspace table, analyst workload, and the top detections by case volume.
The roster
/soc/roster lists every analyst who belongs to a SOC-enabled workspace: a presence dot (Active under 8 hours, Away under 24 hours, otherwise Offline, from their last recorded action), an On call badge from the schedule in Settings, their current open case, and an open-case count. On-call analysts sort first, then the heaviest workload. The page is read-only; shifts are managed on /soc/settings.