Define performance reporting across two queues and the incident lifecycle

In ServiceNow SecOps, I defined MTTA, MTTC and MTTR requirements across two queues, five states and three substates. I established clear state definitions and KPI requirements so reporting reflected the incident lifecycle and assignment-group movement, distinguishing MDR activity from the internal SOC contribution. The reporting was built around this model, supported by dashboards I built to monitor SOC operations.