Analyst-Aware Incident Assignment in Security Operations Centers: A Multi-Factor Prioritization and Optimization Framework

Eyup Can Kilincdemir; Baris Celiktas

Article Details

Analyst-Aware Incident Assignment in Security Operations Centers: A Multi-Factor Prioritization and Optimization Framework

Authors:

Eyup Can Kilincdemir | Baris Celiktas

Publisher:

Karyay Karadeniz Yayımcılık

Main Topics:

Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Journal:

Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Document Type:

Article

Publication Date:

7/2025

Document Language:

English

Document ID (Org No.):

2001346270

pISSN:

2619-8991

Keywords:

Abstract:

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

 In this paper, we propose a comprehensive and scalable framework for incident assignment and prioritization in Security Operations Centers SOCs. The proposed model aims to optimize SOC workflows by addressing key operational challenges such as analyst fatigue, alert overload, and inconsistent incident handling. Our framework evaluates each incident using a multi-factor scoring model that incorporates incident severity, service-level agreement SLA urgency, incident type, asset criticality, threat intelligence indicators, frequency of repetition, and a correlation score derived from historical incident data. We formalize this evaluation through a set of mathematical functions that compute a dynamic incident score and derive incident complexity. In parallel, analyst profiles are quantified using Analyst Load Factor ALF and Experience Match Factor EMF, two novel metrics that account for both workload distribution and expertise alignment. The incidentanalyst matching process is expressed as a constrained optimization problem, where the final assignment score is computed by balancing incident priority with analyst suitability. This formulation enables automated, real-time assignment of incidents to the most appropriate analysts, while ensuring both operational fairness and triage precision. The model is validated using algorithmic pseudocode, scoring tables, and a simplified case study, which illustrates the real-world applicability and decision logic of the framework in large-scale SOC environments. To validate the framework under real-world conditions, an empirical case study was conducted using 10 attack scenarios from the CICIDS2017 benchmark dataset. Overall, our contributions lie in the formalization of a dual-factor analyst scoring scheme and the integration of contextual incident features into an adaptive, rule-based assignment framework. To further strengthen operational value, future work will explore adaptive weighting mechanisms and integration with real-time SIEM pipelines. Additionally, feedback loops and supervised learning models will be incorporated to continuously refine analyst-incident matching and prioritization.

Article Details

Analyst-Aware Incident Assignment in Security Operations Centers: A Multi-Factor Prioritization and Optimization Framework

Authors:

Eyup Can Kilincdemir | Baris Celiktas

Publisher:

Karyay Karadeniz Yayımcılık

Main Topics:

Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Journal:

Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Document Type:

Article

Publication Date:

7/2025

Document Language:

English

Document ID (Org No.):

2001346270

pISSN:

2619-8991

Incident management

Analyst assignment

SOC optimization

Incident prioritization

Correlation score

SLA urgencyIncident management

Analyst assignment

SOC optimization

Incident prioritization

Correlation score

SLA urgency

Issues

Article Details

Authors: Eyup Can Kilincdemir | Baris Celiktas

Publisher: Karyay Karadeniz Yayımcılık

Main Topics: Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Journal: Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Document Type: Article

Publication Date: 7/2025

Document Language: English

Document ID (Org No.): 2001346270

pISSN: 2619-8991

Issues

Authors:

Eyup Can Kilincdemir | Baris Celiktas

Publisher:

Karyay Karadeniz Yayımcılık

Main Topics:

Bilgi Güvenliği Yönetimi | Bilgi Sistemleri Organizasyonu ve Yönetimi

Journal:

Black Sea Journal of Engineering and Science Vol.8 Issue 4, pp.1160-1180

Document Type:

Article

Publication Date:

7/2025

Document Language:

English

Document ID (Org No.):

2001346270

pISSN:

2619-8991