| name | generate-metrics |
| description | Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix). |
| argument-hint | [--period=7d|30d|90d] [--category=artifacts|jira|all] |
Generate Security Metrics
Generate security operations metrics and KPIs. Two data sources: local plugin artifacts (enrichments, reviews, investigations) and Jira ground truth via jr. Deep-dive analyses route to the specialized metrics skills.
Routing to Specialized Skills
| Question | Route to |
|---|
| "How much time do analysts spend on tickets?" | /analyze-ticket-effort |
| "What would client X cost us per year?" / prospect pricing | /model-ticket-cost |
| "What's the real severity distribution?" (no native field) | /extract-severity |
| "Do these dashboard numbers match Jira?" | /verify-metrics-report |
Everything below is generated by this skill directly.
Metrics Categories — Local Artifacts
Enrichment Metrics
- Total tickets enriched in period
- Average enrichment duration (target: 10-15 min)
- Enrichment quality score distribution
- Most common vulnerability types
- Priority distribution (P1-P5 breakdown)
Review Metrics
- Total reviews completed
- Average quality score (target: >= 75%)
- Critical gap frequency
- Most common gap categories
- Review cycle time; adversarial passes to convergence
Investigation Metrics
- Total events investigated
- Disposition distribution (TP/FP/BTP)
- Average investigation duration (target: 15-25 min)
- False positive rate and tuning recommendations
Metrics Categories — Jira Ground Truth (jr)
All computed from jr --output json issue list/view/changelog/comments. List payloads carry created/issuetype/status/assignee; changelogs carry status-transition timestamps; custom fields need issue view.
Every metric below has a concrete recipe — query pattern, extraction code, and reporting conventions — in ${CLAUDE_PLUGIN_ROOT}/data/jira-metrics-recipes.md. Follow the recipes; do not improvise the computations. Recipe 0 (shared fetch layer, changelog shape probe, priority-source rule) runs before any category.
SLA & Responsiveness
- Time-to-first-touch: created → first changelog entry or comment, per priority tier
- Time-to-resolution: created → terminal status transition, vs the P1-P5 SLA table (
data/priority-framework.md)
- SLA breach rate per priority tier and per client
- Patch latency for vulnerability tickets: created → resolved, segmented by KEV-listed vs not
Flow & Backlog Health
- Status dwell time: changelog transitions → hours spent in each status; identifies the bottleneck state
- Cycle time distribution per issue type (median, p85)
- Net flow: created vs resolved per week — backlog growing or draining
- Aging WIP: open tickets bucketed by age (0-7d, 7-30d, 30-90d, >90d)
- Reopen rate: tickets with a transition out of a terminal status
Signal Quality & Noise
- Alert-storm detection: daily created counts, flag days >3σ above trailing mean
- Repeat-offender clusters: near-duplicate summaries/assets recurring → digest-ticket candidates
- False-positive burden: FP disposition share × measured per-ticket effort = hours/month spent on noise (uses
/analyze-ticket-effort priors)
- Ticketing conversion: tickets ÷ upstream alerts (when a pipeline count is provided)
Workload & Distribution
- Assignee distribution: ticket counts and touch-session counts per analyst (SENSITIVE — aggregate for reports; never rank individuals in shared docs)
- After-hours share: sessions starting outside business hours
- Per-client mix shift: type-mix changes month over month
Process
- Parse
--period (default: 30d) and --category (default: all)
- Artifacts pass: scan artifacts/enrichments/, artifacts/reviews/, artifacts/investigations/
- Jira pass: Recipe 0 first (probe changelog shape, decide priority source, load priors); list-level metrics (net flow, aging, storms, workload counts) from cheap list queries; changelog-based metrics (dwell, first-touch, reopen, cycle time) via the background resumable fetch — reuse
/tmp/effort_data/ from a prior effort run when fresh
- Aggregate, compute trends (state R²; ranging rule: R² < 0.3 is not a trend)
- Present summary with targets, breaches, and recommendations; save to
artifacts/metrics/kpi-<period>-<date>.md
- Client names, per-analyst figures, and rates stay in local artifacts — never in committed files or shared output without clearance
References
${CLAUDE_PLUGIN_ROOT}/data/jira-metrics-recipes.md — concrete recipe per Jira metric (READ FIRST for the Jira pass)${CLAUDE_PLUGIN_ROOT}/data/priority-framework.md — P1-P5 SLA targets${CLAUDE_PLUGIN_ROOT}/data/effort-analysis-method.md — fetch patterns, session method, trend rules${CLAUDE_PLUGIN_ROOT}/templates/effort-priors-tmpl.yaml — local org parameters
