메뉴
Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when measuring how much analyst time is spent populating/maintaining Jira tickets, or baselining ticket volume per client/type/month. Reconstructs work sessions from ticket event timestamps (creation, field edits, comments) — works with empty worklogs.
Use when alert severity/criticality exist only as text in analyst worksheet comments (no native Jira field) — extracts them with whitelisted regex over ADF comment bodies and reports coverage.
Use when modeling annual ticket-administration cost for an existing client or a prospect — OSINT T-shirt sizing, analog selection, and Low/Base/High cost scenarios from measured effort priors.
Use when checking an external or automated metrics report (dashboards, colleague spreadsheets, tool-generated counts) against Jira ground truth — window archaeology, boundary-noise tolerance, and derived-column detection.
Opt in to the SecOps Factory companion for this project. Writes .claude/settings.local.json to set the orchestrator (Morgan, the SOC Operations Coordinator) as the default main-thread agent. Reversible via /secops-factory:deactivate.
Reverse /secops-factory:activate — remove the orchestrator default-agent override and the activation metadata from .claude/settings.local.json. Leaves the plugin enabled; only the default persona is cleared.
| name | generate-metrics |
| description | Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix). |
| argument-hint | [--period=7d|30d|90d] [--category=artifacts|jira|all] |
Generate security operations metrics and KPIs. Two data sources: local plugin artifacts (enrichments, reviews, investigations) and Jira ground truth via jr. Deep-dive analyses route to the specialized metrics skills.
| Question | Route to |
|---|---|
| "How much time do analysts spend on tickets?" | /analyze-ticket-effort |
| "What would client X cost us per year?" / prospect pricing | /model-ticket-cost |
| "What's the real severity distribution?" (no native field) | /extract-severity |
| "Do these dashboard numbers match Jira?" | /verify-metrics-report |
Everything below is generated by this skill directly.
All computed from jr --output json issue list/view/changelog/comments. List payloads carry created/issuetype/status/assignee; changelogs carry status-transition timestamps; custom fields need issue view.
Every metric below has a concrete recipe — query pattern, extraction code, and reporting conventions — in ${CLAUDE_PLUGIN_ROOT}/data/jira-metrics-recipes.md. Follow the recipes; do not improvise the computations. Recipe 0 (shared fetch layer, changelog shape probe, priority-source rule) runs before any category.
data/priority-framework.md)/analyze-ticket-effort priors)--period (default: 30d) and --category (default: all)/tmp/effort_data/ from a prior effort run when freshartifacts/metrics/kpi-<period>-<date>.md${CLAUDE_PLUGIN_ROOT}/data/jira-metrics-recipes.md — concrete recipe per Jira metric (READ FIRST for the Jira pass)${CLAUDE_PLUGIN_ROOT}/data/priority-framework.md — P1-P5 SLA targets${CLAUDE_PLUGIN_ROOT}/data/effort-analysis-method.md — fetch patterns, session method, trend rules${CLAUDE_PLUGIN_ROOT}/templates/effort-priors-tmpl.yaml — local org parameters