elastic / elastic/roadmap

MTTD Support and Detection Overview Dashboard

Open
#254 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
6
Forks
1
PR merge metrics
No merged PRs in 30d

Description

**What the feature is (as Title)**
MTTD Support and Detection Overview Dashboard

**Value proposition**
As Security Operations teams use multiple detection rule types (KQL, Lucene, EQL, and ES|QL), there is a need to consistently calculate and visualize Mean Time to Detect (MTTD) across all rule types.

Currently, MTTD calculation depends on fields such as:
- kibana.alert.original_time
- kibana.alert.original_event.ingested
- kibana.alert.start

However, it is unclear whether these fields are consistently available across all rule types, especially ES|QL-based detection rules.

This creates challenges in building a unified dashboard and measuring detection performance accurately.

**Expected outcome**
- Ability to calculate MTTD for all rule types:
- KQL
- Lucene
- EQL
- ES|QL

- Consistent population of required timestamp fields across all alerts
- Support for ES|QL-based rules in MTTD calculations without limitations
- Ability to build a unified Detection Overview Dashboard including all rule types
- Accurate tracking of detection performance (MTTD) across different detection strategies

**use cases**
To measure MTTD across all detection rules so that I can evaluate detection performance consistently
A single dashboard that includes all rule types so that I can track KPIs like MTTD and MTTR
To ensure ES|QL rules are included in performance metrics so that I can compare them with other rule types
To identify delays in detection (ingestion vs rule execution) across all rule types

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.