| Category | Metric | Description | Purpose |
|---|---|---|---|
| Visibility | % CJ coverage per MITRE tactic% CJ coverage per Customized Threat ModelledData Quality Index | Telemetry depth,Coverage per crown jewel and threat model,Completeness, parsing success, latency | Ensures data relevance & usability |
| Detection | % of implemented and tuned detection rules per Threat Modelled% of implemented deception in each operational zoneMean Time to Detect (MTTD) | Ratio of implemented Threat modelled detection rulesTime between compromise and alert, Traceability to threat model | Measures readiness & responsiveness |
| Response | % of implemented Response rule per detection ruleMean Time to Contain (MTTC)Mean Time to Recover/Response (MTTR) | Ratio of implemented response per detectionTime from alert to containment, and resolve | Evaluates efficiency,Measures operationalization,Measures execution |
| Feedback | Detection Validation RateResponse readiness validation | Ratio of tested total detections rules and response playbooks (Whole IR process) | Assessment of learning loop |
| Strategy | % Budget linked to risk priority% of aligned process% of integration & automations% of Covered Detection per Threat Profile & TTPs | Strategic alignmentContinuous improvements, | Confirms governance effectiveness, |
Cite this chapter:
← Back to book contents
Adineh, R. (2026). Metrics and Performance Indicators. UTIOM Framework
Book, edition 1.2. utiom.de/book/metrics/