For an ROI report on analyst activity in SecOps SOAR for the previous month, which option should you use?

• A. Custom SOAR search, export to spreadsheet, calculate ROI.
• B. Use ROI - Analysts Benchmark report in SOAR Reports; configure time period and filter by analysts.
• C. Use Management - SOC Status report.
• D. Develop a playbook to aggregate metrics and generate a PDF monthly.

Answer: (B)

The main idea is to use a built-in ROI reporting feature designed for analyzing analyst activity. The ROI - Analysts Benchmark report in SOAR Reports is specifically built to measure return on investment related to analysts, and it lets you set the time period to the previous month and filter by the analysts you want to include. This gives you a standardized, ready-to-use report focused exactly on the requested scope, without needing manual data gathering or calculations.

Other options require extra steps or don’t target ROI by analysts. A manual route—searching, exporting to a spreadsheet, and calculating ROI—introduces potential errors and inconsistency. A SOC Status report focuses on operational status, not ROI metrics. Building a custom playbook to aggregate metrics and generate a PDF adds work and isn’t as direct as using the dedicated ROI report, which is designed for this purpose.