Recommended Fields for Metric Collection DateTime Occurred DateTime Detected DateTime Contained DateTime Expelled DateTime Owner Notified DateTime Escalated Recommended Mitigation Severity Source Use Case Source Signature Origination MITRE ATT&CK Technique Recommended Metrics Average Cost Per Incident Average Time to Detect Average Time to Escalate Average Time to Contain Average Time to Expel Average Time to Notify Incidents Opened in a given time frame Incidents Closed in a given time frame Count of Incidents per Recommended Mitigation Count of Incidents per Severity Count of Incidents per Severity Not Reviewed Within Required Time Count of Incidents per Alert/Rule/Signature Count of Incidents per Use Case Count of False Positive Incidents Per Use Case Count of Incidents per Attack Technique
Comments