MTTD Support and Detection Overview Dashboard
- Dominant language
- No language data
- Stars
- 6
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
**What the feature is (as Title)**
MTTD Support and Detection Overview Dashboard
**Value proposition**
As Security Operations teams use multiple detection rule types (KQL, Lucene, EQL, and ES|QL), there is a need to consistently calculate and visualize Mean Time to Detect (MTTD) across all rule types.
Currently, MTTD calculation depends on fields such as:
- kibana.alert.original_time
- kibana.alert.original_event.ingested
- kibana.alert.start
However, it is unclear whether these fields are consistently available across all rule types, especially ES|QL-based detection rules.
This creates challenges in building a unified dashboard and measuring detection performance accurately.
**Expected outcome**
- Ability to calculate MTTD for all rule types:
- KQL
- Lucene
- EQL
- ES|QL
- Consistent population of required timestamp fields across all alerts
- Support for ES|QL-based rules in MTTD calculations without limitations
- Ability to build a unified Detection Overview Dashboard including all rule types
- Accurate tracking of detection performance (MTTD) across different detection strategies
**use cases**
To measure MTTD across all detection rules so that I can evaluate detection performance consistently
A single dashboard that includes all rule types so that I can track KPIs like MTTD and MTTR
To ensure ES|QL rules are included in performance metrics so that I can compare them with other rule types
To identify delays in detection (ingestion vs rule execution) across all rule types
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.