Appendix C: Metric definitions
Framework v0.3.0, updated September 19, 2026.
| Metric |
Definition |
Unit and aggregation |
Stage |
| intake_to_score_days |
Days between a request entering the backlog and receiving its first score. |
days, median |
intake |
| backlog_age_days |
How long scored requests have been waiting with no one starting the hypothesis. |
days, median |
intake |
| readiness_at_hypothesis |
Of the requests that reach hypothesis, the share whose data is already in the SIEM in usable shape (readiness 3 or higher). |
percent, ratio |
hypothesis |
| research_hours_per_rule |
Hours logged in research for one rule. |
hours, median |
research |
| percent_with_tests |
Share of rules past the build stage that have both a test event to match and one to ignore. |
percent, ratio |
build |
| first_pass_validation_rate |
Share of pull requests that pass every validation check on the first run. |
percent, ratio |
validate |
| review_turnaround_hours |
Hours from a pull request being marked ready to a second engineer approving it. |
hours, median |
validate |
| deploy_lead_time_days |
Days from a rule being merged to its alert action being switched on. |
days, median |
deploy |
| post_deploy_replay_failures |
Deploys in the quarter where the 7-day production run produced more alerts than the threshold. |
count, sum per quarter |
deploy |
| precision_30d |
Of a rule's alerts in the last 30 days, the share that were true positives. |
ratio, per rule; program median |
tune |
| triage_minutes_median |
Typical analyst minutes spent on one alert from the rule. |
minutes, median |
tune |
| minutes_per_true_positive |
Analyst minutes spent for each true positive the rule produces: triage minutes divided by precision. |
minutes, per rule; program median |
tune |
| rule_debt |
Share of live rules that fired at least once in 180 days and were never right. |
percent, ratio |
retire |
| rules_retired_per_quarter |
Rules set to deprecated in the quarter. |
count, sum |
retire |
| robustness_weighted_coverage |
For each ATT&CK tactic, each live rule counts as its robustness score divided by 5 (a level-5 rule counts as one whole rule, a level-1 rule as one fifth), summed and shown beside the plain rule count. A tactic covered by many easily evaded rules scores low here. |
ratio, per tactic |
program |