<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-incident-trend-analysis
description: >-
  Perform statistical trend analysis on incident data to identify patterns, predict volumes, detect anomalies, and drive strategic security investment decisions.
domain: cybersecurity
subdomain: incident-management
tags:
  - trend-analysis
  - statistics
  - forecasting
  - patterns
  - reporting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.IM-1", "RS.AN-1"]
  frameworks: ["NIST SP 800-61", "SOC-CMM"]
---

# Performing Incident Trend Analysis

## Overview

Trend analysis transforms raw incident data into strategic intelligence.
Identifying patterns in incident categories, severity distribution, root
causes, and timing enables proactive security investment and resource planning.

## Prerequisites

| Requirement | Purpose |
|---|---|
| 12+ months of incident data | Meaningful trend detection |
| Classification consistency | Comparable categories |
| Dashboard tool (Grafana/Tableau) | Visualization |
| Statistical library (pandas/scipy) | Analysis |

## Analysis Dimensions

```
VOLUME TRENDS:
├── Monthly incident count (overall and by severity)
├── Year-over-year comparison
├── Seasonal patterns (end of quarter, holidays)
└── Anomaly detection (sudden spikes/drops)

CATEGORY TRENDS:
├── Top 5 categories by month
├── Emerging categories (new in last 3 months)
├── Declining categories (successful remediation)
└── Category shift analysis (e.g., phishing → BEC evolution)

ROOT CAUSE TRENDS:
├── Top recurring root causes (quarterly)
├── Root causes by system/team
├── Time-to-remediate by root cause type
└── Repeat offender analysis

RESPONSE EFFECTIVENESS:
├── MTTD trend (improving or degrading?)
├── MTTR trend by severity
├── SLA compliance trend
└── Detection coverage growth (ATT&CK heatmap over time)
```

## Statistical Methods

```python
import pandas as pd
from scipy import stats

def detect_trend(monthly_counts: list[int]) -> dict:
    x = list(range(len(monthly_counts)))
    slope, intercept, r, p, se = stats.linregress(x, monthly_counts)
    direction = "increasing" if slope > 0 else "decreasing"
    significant = p < 0.05
    return {
        "direction": direction,
        "slope": round(slope, 2),
        "p_value": round(p, 4),
        "significant": significant,
        "r_squared": round(r**2, 3),
    }
```

## Reporting

```
MONTHLY REPORT:
├── Executive summary (3-5 key findings)
├── Incident volume chart with trend line
├── Category breakdown (current vs previous month)
├── MTTR/MTTD trend charts
├── Top 3 root causes and remediation status
└── Recommendations for next month

QUARTERLY REPORT:
├── Strategic trends and patterns
├── YoY comparison
├── Detection coverage heatmap (ATT&CK)
├── ROI analysis on security investments
└── Resource allocation recommendations
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Monthly trend report automated
- [ ] Statistical significance tested for all trends
- [ ] Category trends reviewed for emerging threats
- [ ] MTTR/MTTD trends shared with leadership
- [ ] Quarterly strategic report delivered to CISO
