Overview
The Torq Value dashboard answers the question: What has Torq delivered for my organization?
It shows the volume of alerts Torq handles, how quickly they are resolved, how many cases are created, and attributes resolution to AI, automation, or an analyst, for better transparency.
The dashboard surfaces key ROI metrics such as analyst time and cost savings, and the capacity your SOC gained from automation, measured against your own benchmark, with the formula behind every number. It covers the full event lifecycle end-to-end, from ingestion, triage, and case creation to automated investigation and response, and to case resolution.
Prerequisites
A Torq organization with Case Management enabled. The dashboard has no data until cases exist.
The Organization Manager or Organization Viewer role, with scopes
roi.config.writeorroi.config.readto view the dashboard.The Organization Manager role, with scope
roi.config.writeto change the benchmark configurations.Auto Triage enabled (optional). Without it, Time to Triage is not calculated, and metrics that depend on triage time will be affected.
How to use
Find the dashboard in your Org Administration area, under Usage. The dashboard is only available at the Organization Management level.
Set your benchmark configurations
Configure benchmarks for comparative analysis. The dashboard is preconfigured with default benchmark values. Set your own values so the numbers reflect your actual analyst costs and the time it takes to handle an alert without Torq, and set different configurations for each alert category.
Benchmark figures impact comparative calculations for handling speed, cost savings, analyst capacity returned to the team, and event lifecycle. Any alert or case-handling time below the set benchmark is included in the time and cost-savings calculation.
Configure your benchmarks:
Open the Analyst benchmark settings panel by clicking on the icon on the top right of the page.
Under Costs, enter your analyst hourly cost. The default is $70/hour.
Under Benchmark, set how long your team takes to handle an alert end-to-end. Use Full for one number, or switch to Breakdown to set triage, case dwell, and investigation times separately. When using Full, Torq's default time assignment is 1:5:6 (for example, for a total handling time of 120 minutes, the default split would be 5 minutes for triage, 25 minutes for dwell time, and 30 minutes for investigation).
Add category exceptions where a specific case category takes longer or shorter than your general benchmark.
Click Save.
Changing the benchmark recalculates the values and trends displayed in the dashboard, including for past periods.
Changing a benchmark setting generates a Torq audit log entry.
Definitions
Triage time: The time from alert ingestion to verdict by Auto Triage. This is counted only for alerts processed by Auto Triage, when Auto Triage is enabled.
Case Dwell time: The time a case waits in the queue for pickup. This is the time from case creation to assignment to an analyst.
Investigation and Response time: The time it takes to investigate and respond to a case. This is counted from the time a case is assigned until it is resolved.
Global filters
Use the time range, workspace, and category filters at the top of the dashboard to scope the view down to a single workspace. Three global filters apply across the whole page:
Time range: Select the time range to view data for; the default is the last 30 days.
Workspace: Scope the view to specific workspaces; the default is all workspaces.
Category: Select case categories to view data for; the default is all case categories.
Case tags: Select tags to focus data; the default is all tags.
Resolution reason: Select resolution reasons to view specific data; the default is all resolution reasons.
Headline widgets
The top row provides ROI insights at a glance, with each figure calculated against your configured benchmark. Click any widget to open its drill-down drawer for full details, trends, and formula.
Noise reduction with Auto Triage: The share of alerts Auto Triage classified as non-malicious and therefore required no handling by an analyst. Applicable for accounts with Auto Triage enabled.
Analyst time saved: The total hours Torq returned to your organization reflecting the overall outcome of incident handling, measured against your benchmark. Every alert or case that is handled faster than the benchmark contributes to the total.
Alerts handled by Auto Triaged faster than the defined benchmark
Cases with MTTR below the defined benchmark
Analyst cost saving: The value of the time saved, using your benchmarked hourly cost.
Analyst capacity reclaimed: The same time saved, expressed as full-time equivalent (FTE). FTE is the analyst time saved shown as the number of full-time analysts (working 40 hours per week) it is equivalent to.
Analyst time saved, cost savings, and capacity reclaimed all stem from the same underlying metric of total hours saved, expressed in hours, the selected currency, and FTEs, respectively. See Metrics reference below for how that number is built.
If your overall analyst time saved is low, treat it as a signal to check your benchmark configuration or look at where automation could help.
SOC lifecycle
This section follows an alert from ingestion through case resolution. It credits whoever handled each stage: Auto Triage, an AI Agent, a workflow, or an analyst.
Incoming events: The number of events Torq received in the period, and from which sources. This includes both external events and any event that created a case, including manual or workflow case creation.
Events triage & processing: The number of those events that were resolved or handled by Torq before a case was actually needed, and which entity resolved it.
Investigation & response: Of the cases that were created, the number that were resolved fully automatically versus those that included analyst handling, and the outcomes categorized by resolution reasons or severity.
A case is considered to have analyst involvement when at least one manual user action is recorded in the case timeline. Everything else counts as fully automated. Only resolved and closed cases are counted; open cases do not yet have a full lifecycle to measure.
Two further widgets compare cases resolved fully automatically to cases with analyst involvement, and handling time against the defined benchmark.
Resolution speed, automated vs. analyst-involved: Compares MTTR for cases Torq handled fully automatically (by Agents, Socrates, workflows, or AI) versus cases where an analyst performed at least one action.
Handling time breakdown: each phase is shown visually and compared against the globally defined benchmark. Actual mean time in each phase (Auto Triage, Case dwell time, Investigation and Response, Full lifecycle), against your benchmarks.
Click See trend to expand a widget to a trend chart so that you can tell a single strong month apart from a sustained trajectory.
Operational insights
The Analyst effort map takes cases that included analyst involvement and plots every case category on three axes:
X-axis is the case resolution time (MTTR)
Y-axis is the number of actions on a case (involvement intensity)
Circle size is the case volume in that category
A category that is slow, largely manual, and high-volume is a prime candidate for automation.
Export a report
Click Export to PDF to generate a PDF of the current dashboard view. To export a report, Org Manager (scope: roi.config.write) or Org Viewer (scope: roi.config.read) permissions are required. Exporting a report generates a Torq audit log entry.
Metrics reference
Metric | What it measures | Formula |
Noise reduction with Auto Triage | Share of alerts Auto Triage closed as non-malicious (false positive or true positive, benign) | (Non-malicious alerts ÷ Total alerts processed by Auto Triage) × 100 |
Analyst time saved | Total hours saved through automation, compared to your benchmark | Sum of (benchmark time - actual time) |
Analyst cost saving | Dollar value of hours saved, at your hourly rate | Hours saved × analyst hourly rate |
Analyst capacity reclaimed | Hours saved, expressed as full-time analysts | Hours saved ÷ working hours in the period |
Incoming events | Events Torq received in the period | All external events processed in the selected period, including manually created cases counted as source"Huma" |
Events triage & processing | Share of events resolved before a case was opened | (Events with no case ÷ Total events) × 100 |
Investigation & response | Share of resolved cases with no analyst involvement | (Cases with no analyst action ÷ Resolved cases) × 100 |
Resolution speed, automated vs. analyst involved | How much faster fully automated cases resolve than analyst-involved ones | MTTR = mean(case resolved time − case created time), calculated separately for each group |
Handling time breakdown | Actual mean time per phase, against your benchmark for that phase | Mean(phase end − phase start), across resolved cases |
Analyst effort map | Analyst involvement per case category | (Cases with analyst action ÷ Cases in category) × 100 |
Hours saved is the number behind Analyst time saved, cost saving, and capacity reclaimed:
A resolved case counts only if it closed within its benchmark. It adds the benchmark minus the actual time from alert to resolution.
With Auto Triage, each alert closed without a case adds the triage benchmark minus the actual triage time.
Only cases with handling times below the benchmark are counted.
Frequently asked questions
Why is my Analyst Time Saved low?
It means your SOC is resolving cases at or below the benchmark you set for the current time range and categories. Cases that run longer than the benchmark count as zero toward the total, never as a negative value, so time saved can bottom out at zero but won't go below zero. Use a low number as a signal to revisit your benchmark or look at where automation could help.
Does my Time Saved include data from workflows?
No. Time saved is based on data from alerts processed by Auto Triage and case resolution time, relative to the defined benchmark.
Who can change the benchmark or hourly rate?
Only users with the Organization Manager role can change the benchmark or hourly rate. Viewing the dashboard requires Organization Manager or Organization Viewer.