Metrics, Indicators and Coverage
🌟 Objective
To define metrics and indicators to assess the effectiveness, coverage and maturity of the monitoring, detection and response controls, enabling continuous improvement based on operational data.
This file is an operational synthesis for day-to-day reading. The canonical catalogue of
OPS-Kxxis in11-kpis-metricas.md.
📏 Coverage indicators
| Metric | Objective |
|---|---|
| % of critical flows with logging | Assess minimum visibility over sensitive operations |
| % of logs sent to the SIEM | Measure adherence to centralisation |
| % of alerts with a tested trigger | Validation of the effectiveness of the alerts |
| % of components with ECS tagging | Assess consistency and normalisation |
| % of pipelines that produce events | CI/CD coverage in the detection of suspicious events |
⏱️ Operational indicators
| Metric | Meaning | Calculation example |
|---|---|---|
| MTTD (Time to Detect) | Mean time from event to alert | timestamp_alert - timestamp_event |
| MTTR (Time to Respond) | Mean time until the start of mitigation | timestamp_action - timestamp_alert |
| False positive rate | % of non-relevant alerts | invalid alerts / total alerts |
| Events per user/day | Normal average activity for the baseline profile | comparative baseline |
| Incidents by category | Classification of cases by type (access, fraud) | logs or IR tickets |
🌟 MTTD and MTTR are key indicators of operational maturity.
📊 Suggested dashboards and reports
| Dashboard type | Data included |
|---|---|
| Logging coverage | Apps without structured logs, by criticality |
| Alert quality | Active/tested triggers, % of false positives |
| Events and context | Events by type, IP, user, system |
| Detection and response | MTTD, MTTR, by severity, as a time series |
| Anomalous patterns | Outliers by role, geography, time of day, device |
🌄 Integration with maturity
| Maturity level | Expected indicators |
|---|---|
| L1 (minimum) | Local logging active, occasional manual analysis |
| L2 (moderate) | Automatic alerts with tuning, basic operational dashboards |
| L3 (advanced) | Correlation of sources, behavioural detection, KPIs such as MTTD/MTTR |
📊 These metrics also contribute to Chapters 10 (Security Testing) and 11 (Execution Control).
✅ Final recommendations
- Measure and publish metrics at least monthly
- Set improvement targets (e.g. -20% MTTD in 3 months)
- Correlate metrics with real events and simulated exercises
- Prioritise visibility and coverage of critical assets
💡 Without measurement, there is no improvement. Quantitative visibility is essential to security maturity.