Splunk Phantom has a useful widget on the dashboard called Automation ROI Summary. With it, we get a summary of automation gains made with Phantom, including the total resolved events, mean dwell time, mean time to resolve, and some metrics around “return on investment” or ROI. These ROI metrics can be a bit mysterious in how Phantom calculates them, so in this blog post, I’ll go over just that and how to tweak them to fit your environment.
Phantom ROI Settings
Phantom builds it’s ROI metrics based on three user-provided values: annual analyst salary, analyst hours per day, and minutes per action.
- Annual analyst salary: The average annual salary paid to each analyst
- Analyst hours per day: The typical number of hours each analyst works per day
- Minutes per action: The average number of minutes an analyst typically spends on any action in a case (not using Phantom)
In Phantom 4.8, these values can be set in on the Administration page under Company Settings and then Dashboard. Here you can also set which metrics are displayed in the widget and the currency used for the Money Saved metric.
Phantom ROI Metrics
Once you have tweaked these settings to suit your environment, Phantom takes those values and calculates three ROI metrics: FTE gained, time saved, and dollars saved.
- FTE Gained: To calculate this value, Splunk Phantom divides the number of actions run by automation (calculated in Splunk Phantom) by the number of expected actions an analyst would take (based on minutes per action and analyst hours per day)
- Time Saved: To calculate this value, Splunk Phantom sums the difference between the analyst minutes per action and the actual minutes per action (calculated in Splunk Phantom) over all actions for the past 24 hours.
- Money Saved: To calculate this value, Splunk Phantom multiplies the average time an analyst spends per action and the average analyst salary by the number of actions run by automation (calculated in Splunk Phantom).
If math is more your thing, here’s another way to look at it:
FTE Gained = (Actions run by automation/((Analyst hours per day * 60)/normal minutes per action))
Time Saved = Sum of (normal minutes per action – actual minutes per action in Phantom) for all actions performed by Phantom
Money Saved = (Analyst salary per minute * normal minutes per action) * number of actions run by Phantom
Hopefully, this clears up the Phantom ROI widget and helps you get more value from it.
References: