<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-incident-metrics-tracking
description: >-
  Build incident metrics dashboards tracking MTTD, MTTR, MTTC, recurrence
  rates, escalation accuracy, and process compliance KPIs to measure and
  improve incident response program effectiveness.
domain: cybersecurity
subdomain: incident-management
tags:
  - metrics
  - mttd
  - mttr
  - kpi
  - dashboard
  - reporting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.IM-1", "RS.AN-1"]
  frameworks: ["NIST SP 800-61", "SOC-CMM"]
---

# Implementing Incident Metrics Tracking

## Overview

Incident metrics quantify response program effectiveness and identify
improvement opportunities. Covers KPI definition, data collection from
ticketing systems, metric computation, and dashboard construction.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Ticketing system with timestamps | MTTD/MTTR calculation |
| Incident classification data | Breakdowns by severity/category |
| Dashboard tool (Grafana/Kibana) | Visualization |

## Core Metrics

```
TIMING METRICS:
├── MTTD: avg(declared_at - first_indicator_at) — Target < 24hr
├── MTTR: avg(first_response_at - declared_at) — Per SLA
├── MTTC: avg(contained_at - declared_at) — S1 < 1hr, S2 < 4hr
└── MTTClose: avg(closed_at - declared_at) — S1 < 48hr

QUALITY METRICS:
├── Escalation Accuracy: correct severity at declaration %
├── Recurrence Rate: reopened / total
├── Documentation Completeness: filled / required fields %
└── Action Item Closure: completed on time %

VOLUME METRICS:
├── Incidents per month (by severity, category)
├── Incidents per analyst (workload)
└── SLA compliance rate (per severity tier)
```

## Calculation Examples

```python
from datetime import datetime

def compute_mttr(incidents: list[dict]) -> float:
    deltas = []
    for inc in incidents:
        declared = datetime.fromisoformat(inc["declared_at"])
        responded = datetime.fromisoformat(inc["first_response_at"])
        deltas.append((responded - declared).total_seconds() / 60)
    return sum(deltas) / len(deltas) if deltas else 0.0
```

## Dashboard Layout

```
ROW 1: MTTD (gauge) | MTTR (gauge) | MTTC (gauge) | SLA %
ROW 2: Incidents by severity (stacked bar) | MTTR trend (line)
ROW 3: Incidents by category (pie) | Top recurring types (table)
ROW 4: Doc completeness | RCA rate | Action closure rate
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Core timing metrics computed automatically
- [ ] Dashboard displays MTTD, MTTR, MTTC with trends
- [ ] SLA compliance tracked per severity
- [ ] Monthly metrics review scheduled
- [ ] Recurrence rate trending downward
