BRUJO: Baseline-calibrated Risk from Unified Joint Observations for MITRE ATT&CK-based Time Series Forecasting in Security Operations Centers

Security Operations Center (SOC) teams face incident volumes exceeding analyst capacity. Time series analysis in cybersecurity typically relies on aggregated counts and opaque scores, limiting customer-level action and weakening alignment with MITRE ATT&CK tactics. This work presents BRUJO, a baseline-calibrated risk profiling method for shift-level SOC operations. BRUJO builds hourly incident series per customer and tactic, forecasts one week ahead conditioned on 168 hours of the week, and separates sustained and intermittent regimes using Error-Trend-Seasonality (ETS) models and Croston-type estimators. A calibration layer clips forecasts using hour-of-week statistics. Forecasts and realised incidents combine into hourly risk vectors and shift-aligned health indices. Evaluation on Microsoft Sentinel telemetry shows average root mean squared error of 0.28 incidents per hour, mean absolute error of 0.18 incidents per hour, and determination coefficient near 0.80. Over the evaluated week, 66.1% of hours fall in excellent health, 22.6% in moderate health, and 11.3% in poor health.