<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-detection-retrospective-analysis
description: >-
  Perform retrospective analysis of detection rule performance including alert quality metrics, coverage gaps, false positive trends, and detection engineering maturity assessments.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - detection-metrics
  - retrospective-analysis
  - alert-quality
  - coverage-gaps
  - maturity-assessment
  - detection-kpis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Detection Retrospective Analysis

## Overview

Detection retrospective analysis evaluates the effectiveness of detection
rules over time. Covers alert quality scoring, mean time to detect (MTTD),
false positive analysis, coverage trending, and maturity model assessment.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM access | Alert and log query capability |
| Alert metadata | Rule firing history and triage outcomes |
| ATT&CK Navigator | Coverage visualization and tracking |

## Key Concepts

### Detection Metrics Framework

```yaml
# Detection retrospective analysis configuration
analysis:
  period: "2026-Q1"
  metrics:
    alert_quality:
      true_positive_rate: "TP / (TP + FP)"
      false_positive_rate: "FP / (TP + FP)"
      mean_time_to_detect: "avg(alert_time - attack_time)"
      mean_time_to_triage: "avg(triage_time - alert_time)"
    coverage:
      techniques_covered: "rules_with_technique / total_techniques"
      data_source_coverage: "monitored_sources / required_sources"
      platform_coverage: "platforms_monitored / platforms_in_scope"
    maturity:
      level_1: "Ad-hoc rules, no testing"
      level_2: "Documented rules, manual testing"
      level_3: "Automated validation, CI/CD pipeline"
      level_4: "Continuous improvement, ML-augmented"
      level_5: "Threat-informed, proactive detection"
```

## Workflow

1. **Define metrics** — Establish KPIs for detection quality and coverage
2. **Collect data** — Gather alert outcomes, triage results, and timing data
3. **Analyze quality** — Calculate TP/FP rates and detection latency metrics
4. **Assess coverage** — Map current detections against ATT&CK and data sources
5. **Identify gaps** — Document coverage gaps with prioritized remediation
6. **Evaluate maturity** — Score detection program against maturity model
7. **Report and plan** — Present findings and prioritize improvement roadmap

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
