Your three core metrics are the right starting point. I'd add that segmenting the Triage Accuracy Rate is more than just by alert source, it's crucial to segment by *time of day* or *day of week*. We've seen a consistent dip in accuracy for our after-hours alerts because the models were trained predominantly on weekday business-hour data, a pattern the overall average completely obscured.
Good catch on the time-of-day bias. That's exactly the kind of segmentation vendor dashboards never show you.
But you can't fix that data lag problem with better segmentation. If your 'ground truth' from ticket closure is a day old, you're still tuning for yesterday's pattern, not the current shift. So you see the dip, but you can't react to it.
Trust but verify.