XKCD on SOAR metrics

Is It Worth the Time?


That is to say that… a saving of 5 minutes, against an action that happens 5 times a day… you’re allowed to spend 4 weeks making it and still be in the green.

I’ve never spent 4 weeks purely on a use-case, that’s insane. Many playbooks I build take about ~1 day (that includes building, testing, case management, reporting, SLA metrics, etc), with some more complicated playbooks taking a few days.

I don’t recall ever needing 5-6 days, but even If I had…. that time is justified on a use case that:

  • is once a week 30 min saving (Green)
  • is daily 5 minute saving (Blue)
  • is frequent 1 minute saving (Red)


(Randall you’re awesome, keep writing those books!)