--- title: "Measure and optimize security team efficiency with Cloud SIEM security operational metrics" description: "Datadog Cloud SIEM security operational metrics provide deep insights into the performance of your security team, helping you assess how effectively they respond to and resolve threats in cloud environments." author: "Vera Chan, Nimisha Saxena, Anes Bendimerad, Jesse Mack" date: 2024-11-11 tags: ["security", "cloud siem"] blog_type_id: the-monitor locale: en --- Many organizations lack clear visibility into the efficiency of their security processes, making it difficult to accurately assess their security teams’ performance. Without insight into key factors like alert response speed, investigation thoroughness, and the accuracy of detection rules, teams risk operating without a clear view. This can lead to missed threats, inefficient use of resources, and an inability to improve security outcomes. To give security teams enhanced insights into how they are performing, [Datadog Cloud SIEM](https://www.datadoghq.com/product/cloud-siem/) delivers comprehensive security operational metrics—**mean time to detect (MTTD)**, **mean time to acknowledge (MTTA)**, and **mean time to resolve (MTTR)**—that offer clear visibility into your teams’ effectiveness. With these insights, security teams can streamline their processes, address threats promptly, and continuously optimize operations to enhance security performance. In this post, we’ll cover: - [How Datadog calculates security operational metrics](#how-datadog-calculates-security-operational-metrics) - [How to visualize the metrics in dashboards](#use-dashboards-to-visualize-security-operational-metrics) - [How to explore, tag, and track progress on your security operational metrics](#explore-tag-and-monitor-security-operational-metrics) ## How Datadog calculates security operational metrics Security operational metrics are [distribution metrics](https://docs.datadoghq.com/metrics/types.md?tab=distribution#metric-types)—these are calculated across the entirety of your distributed infrastructure at specific intervals, providing accurate percentile aggregations, as well as the ability to customize tags. The three security operational metrics available in Datadog Cloud SIEM are: - `Datadog.security.siem_signal.time_to_detect`: **Time to detect (TTD)** measures the time from when a log triggers a security signal (T0) to when the signal is generated (T1), representing the speed of threat detection. - `Datadog.security.siem_signal.time_to_acknowledge`: **Time to acknowledge (TTA)** tracks the time from signal generation (T1) to when the signal is marked as under review (T2), showing how quickly teams initiate investigations. - `Datadog.security.siem_signal.time_to_resolve`: **Time to resolve (TTR)** measures the total time from signal generation (T1) to when the signal is archived (T3), reflecting the duration required to fully resolve the incident. These metrics enable security teams to monitor and enhance their detection and response times, ensuring quick action against security threats. ## Use dashboards to visualize security operational metrics The [Cloud SIEM Overview dashboard](https://app.datadoghq.com/dash/integration/30378/cloud-siem-overview) now includes security operational metrics out of the box, so that teams can quickly and easily start tracking MTTD, MTTA, and MTTR to evaluate and improve the effectiveness of their incident response. ![Security Operational Metrics section in Cloud SIEM Overview dashboard](https://web-assets.dd-static.net/42588/1776304478-security-operational-metrics-security-operational-metrics-image-1.png) With these metrics, you can spot trends, measure improvements, and ensure your team is consistently optimizing its response workflows to minimize potential security risks. The ability to customize time ranges provides additional flexibility in how you query these metrics. You can also add security operational metrics to your own custom [dashboards](https://docs.datadoghq.com/getting_started/dashboards.md), giving teams the flexibility to monitor threats and response times in the dashboards they already use. ## Explore, tag, and monitor security operational metrics To explore security operational metrics in greater depth, you can also use the [Metrics Summary](https://app.datadoghq.com/metric/summary?filter=security.siem&metric=datadog.security.siem_signal.time_to_acknowledge), which provides a centralized view of all your metrics, including important metadata and context. Here, you can see exactly which dashboards, notebooks, monitors, and SLOs are using your security operational metrics, giving you visibility into how this data is being leveraged across your security operations. This summary helps you ensure that teams are tracing and using all relevant metrics to understand their performance and inform security strategy. ![Security operational metrics in Metrics Summary](https://web-assets.dd-static.net/42588/1776304483-security-operational-metrics-security-operational-metrics-image-2.png) You can also use tags to further enhance the usability of these metrics and filter them based on specific teams, data sources, or environments. This granularity lets you focus on the most relevant data for different segments of your security infrastructure. Once filtered, you can create custom dashboards to visualize key metrics or set up [monitors](https://docs.datadoghq.com/getting_started/monitors.md) that trigger alerts when certain thresholds are met. ![Filter security operational metrics by source and other facets](https://web-assets.dd-static.net/42588/1776304488-security-operational-metrics-security-operational-metrics-image-3.png) To help you stay on top of your operational metrics, Datadog Cloud SIEM generates [weekly digest reports](https://app.datadoghq.com/security/configuration/reports) that provide a consolidated overview of key metrics and operational insights. These reports summarize critical information such as alert volumes, response times, and investigation outcomes, allowing teams to assess their performance and identify trends over time so they can proactively address vulnerabilities and optimize their security operations. ![Subscribe to Cloud SIEM reports](https://web-assets.dd-static.net/42588/1776304492-security-operational-metrics-security-operational-metrics-image-4.png) ![Schedule reports and add recipients](https://web-assets.dd-static.net/42588/1776304496-security-operational-metrics-security-operational-metrics-image-5.png) ## Get valuable insights with security operational metrics Datadog Cloud SIEM security operational metrics offer valuable insights into your teams' effectiveness and facilitate seamless monitoring, enabling you to respond effectively to evolving threats, maintain a stronger security posture, and ensure that your cloud environments remain secure and resilient. Check out our [in-depth guide](https://www.datadoghq.com/blog/key-security-metrics.md) for more information about monitoring these and other key security metrics. If you’re already a Datadog customer, see our [documentation](https://docs.datadoghq.com/security/cloud_siem/security_operational_metrics.md) so you can start exploring security operational metrics in the Cloud SIEM Overview [dashboard](https://app.datadoghq.com/dash/integration/30378/cloud-siem-overview) and start receiving [weekly digest reports](https://app.datadoghq.com/security/configuration/reports) now. If you’re not a customer, you can get started today with a 14-day .