Analytics

The filters

Three controls in the top right filter the whole page:

• Project counts only the cases of one project. Inactive projects are in the list too. The Project analytics link on a project page opens this page with that project selected.
• All, Investigations, Incidents counts only one kind of case.
• The date range sets the period. See The date range.

The line under the page title names the project and the kind of case that the numbers cover.

The key figures

Six cards sit at the top of the page.

Card	What it counts
Cases opened	Cases created in the period.
Cases closed	Closures in the period. A case that was closed and then reopened in the period counts here and under Cases reopened. Archiving a closed case is not a second closure.
Open at period end	Cases that were open at the end of the last day of the period. The line below gives the number at the start of the period. A reopened case counts as open only in the periods when it was open.
Incidents declared	Incidents declared in the period. This includes investigations that were escalated in it.
Time to acknowledge	Median time from the creation of a case to its first acknowledgement, for cases first acknowledged in the period. Investigations count too.
Time to resolve	Median time from the declaration of an incident to its first resolution, for incidents first resolved in the period.

The two time cards show the median. The line below gives the number of cases and the average.

The counts agree with each other. Take the cases open at the start, add the cases opened and reopened, and subtract the cases closed. The result is the cases open at the end.

What time to resolve measures

Resolution is the first time an incident enters the resolving phase, or a phase after it. An incident closed without reaching that phase counts up to its closure instead. A reopened incident keeps its first resolution, so it is counted once, in the period of that resolution. The resolve SLA target ends at the same moment. The figure is calendar time: a pause of the resolution SLA does not shorten it, so an incident that waited three days on another party still reads as resolved in the days it took. The figure covers incidents only. An investigation has no declaration time, so nothing marks the start.

The SLA gauges

Two gauges show the incident SLA result of the period. Acknowledge SLA met is the share of the acknowledge targets in the period that were met. Resolve SLA met is the same for the resolve targets. The line under each gauge gives the counts, and the bars beside it give the share for each severity. A target counts under the severity that its clock ran against.

A met target counts in the period in which its clock stops. A breached target counts in the period of its deadline, also while the incident is still open, and in no other period. For example, an incident declared at the end of June that misses its deadline in July counts as breached in July, even if someone acknowledges it in August. A pause of the resolution SLA that starts after a breach does not move the breach to a later period.

The gauges show only when a target counts in the period. SLA targets belong to a project and apply to incidents only. See Incident SLA targets.

More figures

The panel below the breakdowns gives the supporting numbers:

• Cases reopened in the period.
• New cases now: open cases that nobody has acknowledged.
• Open incidents past an SLA target now.
• Case duration, median: the time that cases closed in the period spent open.
• Evidence items added in the period.
• Compliance timers completed in time, of the timers completed in the period.
• Users active in the period, of all active accounts. This figure is for the installation, so it is hidden while a filter is set.

Changes from the period before

A small triangle beside a figure shows how the figure changed from the period before. The number beside it is the size of the change. Hold the pointer over it to read the earlier value.

• A period of whole calendar months is compared with the same number of months before it. September is compared with August, and a quarter with the quarter before.
• Any other period is compared with a period of the same length that ends the day before it starts.

The line at the bottom of the page, and the header of the report, name the period that the changes are against.

Figure	Change shown as	Color
Acknowledge SLA met, Resolve SLA met	Percentage points	Green when it rises, red when it falls.
Time to acknowledge, Time to resolve	Percent of the earlier time	Green when it falls, red when it rises.
Incidents declared	Number of incidents	Red when it rises, green when it falls.
Critical and high cases, in By severity	Number of cases	Red when it rises, green when it falls.
Cases opened, Cases closed, Open at period end, and the other severities	Number of cases	No color.

Green means that the situation is better and red that it is worse. A figure has no triangle when one of the two periods has nothing to compare, for example when no SLA target counts in the earlier period. A dash means that the figure did not change.

The tables and charts

• Time to acknowledge and Time to resolve give the number of cases, the median and the average for each severity. A bar beside each median compares the severities.
• Cases opened and closed shows the two counts as bars. A period of up to 31 days is counted per day, a period of up to 26 weeks per week, and a longer period per month.
• Open cases shows the cases left open at the end of each day, week or month.
• The breakdowns count the cases opened in the period by severity, type, status, ENISA category, outcome, playbook and project, as bars with the count beside each. A breakdown without cases is not shown, and By project is not shown while a project is selected.
• Case status at period end gives the status that each of those cases had at the end of the last day of the period. A report on a past month therefore shows the same split whenever you open it.
• Evidence items added per day plots evidence collection.

The report

Report opens a printable report for the period and the filters that are set. The report has the key figures, the SLA gauges, the tables, the charts with their numbers in a table, the breakdowns and a list of the cases created, declared or closed in the period. It is in color and prints in landscape, on a light background in either theme. In the case list, a critical case has a red row and a high case an amber row, and an open case has its status in bold. The Ack and Res columns give the result of the acknowledge and resolve targets: a check for a target met, a cross for one breached, and a clock for one still running. A case counts as declared when someone creates it as an incident or escalates it to one. For a report to a customer, select the project first.

To save the report as a PDF:

1. Select Report on the Analytics page.
2. Select Print report.
3. In the print dialog of the browser, select the PDF printer.

The browser suggests a file name with the project, when one is selected, and the period.

The case list holds up to 500 cases. The report says so when it is cut.

The date range

The picker starts on the last 30 days. This month and Last month select whole calendar months, which fits a monthly report. Changing the range updates every figure at once.

Everything is computed from live case data when you open the page. There is no separate analytics store to refresh or fall behind.