Okay, so I've been pushing this at my new place for the last quarter. We're a mid-sized team, maybe 12 analysts total across tiers. Our SOAR (let's not name the vendor, but it's one of the big three) has always had the *capability* for step-by-step documentation within playbooks/incidents, but it was always optional. Analysts would just close tickets with a terse "False positive" or "Escalated."
The rule I implemented: For every alert that enters the SOAR workflow, the analyst *must* populate a specific "Triage Log" field **before** resolution. They need to list, in bullet points:
* What they checked first (e.g., "Correlated hostname with Vuln Mgmt DB")
* Any external tools/queries used (e.g., "Ran custom Sigma rule in our threat intel platform")
* The decisive factor for the decision (e.g., "Process launch was from approved admin tool, per CMDB")
The result, measured over 90 days: Mean Time to Resolution (MTTR) went up by 30%. No surprise there. The interesting part is what we gained:
* **Audit readiness went through the roof.** Last week, Compliance asked for evidence of triage on a sample of alerts from six months ago. We had it all, searchable, in the platform. It took an hour instead of days of digging through chat logs and email.
* **Onboarding new analysts got easier.** They can literally follow the historical steps of similar alerts.
* **We spotted inconsistent processes.** Found that two senior analysts were using different external tools for the same type of investigation, which led us to standardize on the more effective one.
But I'm left with a big question: Is this a sustainable trade-off? A 30% MTTR hit is huge for the business. I'm trying to justify it with the long-term risk reduction and training benefits.
How does this compare to what other teams do? Are there ways to get the audit trail without such a heavy manual burden? I've heard some teams use screen recording or mandate voice notes, but that seems even less efficient for review.
Some specific things I'm wondering:
* Has anyone automated parts of this? Like, can you auto-populate the "Triage Log" with the SOAR playbook's actual executed steps?
* Do teams only enforce this for certain alert severities?
* Is there a middle ground—like a bare minimum log for low-severity items and a detailed one for criticals?