Engineering Security Metrics Operational

Security Incident Count

Security Incident Count: Number of security incidents in a period.

Formula

Security Incident Count = Count of incidents of type security started in the period

Computable definition

The canonical formula in the GASP formula grammar. The MCP server compiles it to SQL over the datasets listed below.

count_distinct(field.incident_id where field.incident_type = 'security')

Unit: count

Data requirements

Grain: Per event · Frequency: Per incident · Aggregation: event · Staged: no · Main source: Incident Management.

Field	Dataset	Type
`incident_id`	incident	string
`incident_type`	incident	string
`started_at`	incident	timestamp

Example SQL (Postgres)

SELECT (SELECT COUNT(DISTINCT incident_id) FROM incident WHERE started_at >= :period_start AND started_at < (:period_end + INTERVAL '1 day') AND incident_type = 'security') AS security_incident_count

From an agent: with the GASP MCP server, call lookup_metric({ "name": "Security Incident Count" }) or generate_query({ "metric": "Security Incident Count", "adapter": "<your adapter JSON>" }).

← Back to Engineering metrics