Overview

Cloud SIEM provides security operational metrics to help you determine the effectiveness of your team in responding to and resolving security threats to your cloud environments. These metrics are shown in the out-of-the-box Cloud SIEM dashboard and are sent in the Cloud SIEM weekly digest reports. You can also create dashboards and monitors for them.

Operational metrics

datadog.security.siem_signal.time_to_detect

Name: Time to Detect (TTD)

Description: The time between when a matching log is triggered and when a signal is generated.

Metric type: DISTRIBUTION

datadog.security.siem_signal.time_to_acknowledge

Name: Time to Acknowledge (TTA)

Description: The time between when a signal is triggered and when an investigation on the signal begins.

Metric type: DISTRIBUTION

datadog.security.siem_signal.time_to_resolve

Name: Time to Resolve (TTR)

Description: The time it takes to close a signal starting from the time when you are first notified of the detection.

Metric type: DISTRIBUTION

How the metrics are calculated

The TTD, TTA, and TTR metrics are calculated based on these timestamps:

1. The timestamp (T0) of the log that triggers a security signal.
2. The timestamp (T1) of when the signal is generated.
3. The timestamp (T3) of when the signal status is changed to under_review.
4. The timestamp (T4) of when the signal status is changed to archived.

Explore, visualize, and monitor the metrics

Use the Metrics Summary to see metadata and tags for the operational metrics. You can also see which dashboards, notebooks, monitors, and SLOs are using those metrics.

Use tags to filter the metrics to specific teams, sources, and environments. You can then create dashboards for those metrics to visualize the data or create monitors to alert you if the metrics exceed a specified threshold.

Further reading

Additional helpful documentation, links, and articles:

Investigate Cloud SIEM Security SignalsDOCUMENTATION Getting started with dashboardsDOCUMENTATION Getting started with monitorsDOCUMENTATION Learn more about the Metrics SummaryDOCUMENTATION