generate-metrics

name	generate-metrics
description	Use when generating security operations metrics and KPIs — from local enrichment/review artifacts AND from Jira ground truth via the jr CLI (SLA compliance, cycle time, backlog health, alert storms, workload, disposition mix).
argument-hint	[--period=7d|30d|90d] [--category=artifacts|jira|all]

Generate Security Metrics

Generate security operations metrics and KPIs. Two data sources: local plugin artifacts (enrichments, reviews, investigations) and Jira ground truth via jr. Deep-dive analyses route to the specialized metrics skills.

Routing to Specialized Skills

Question	Route to
"How much time do analysts spend on tickets?"	/analyze-ticket-effort
"What would client X cost us per year?" / prospect pricing	/model-ticket-cost
"What's the real severity distribution?" (no native field)	/extract-severity
"Do these dashboard numbers match Jira?"	/verify-metrics-report

Everything below is generated by this skill directly.

Metrics Categories — Local Artifacts

Enrichment Metrics

• Total tickets enriched in period
• Average enrichment duration (target: 10-15 min)
• Enrichment quality score distribution
• Most common vulnerability types
• Priority distribution (P1-P5 breakdown)

Review Metrics

• Total reviews completed
• Average quality score (target: >= 75%)
• Critical gap frequency
• Most common gap categories
• Review cycle time; adversarial passes to convergence

Investigation Metrics

• Total events investigated
• Disposition distribution (TP/FP/BTP)
• Average investigation duration (target: 15-25 min)
• False positive rate and tuning recommendations

Metrics Categories — Jira Ground Truth (jr)

All computed from jr --output json issue list/view/changelog/comments. List payloads carry created/issuetype/status/assignee; changelogs carry status-transition timestamps; custom fields need issue view.

Every metric below has a concrete recipe — query pattern, extraction code, and reporting conventions — in ${CLAUDE_PLUGIN_ROOT}/data/jira-metrics-recipes.md. Follow the recipes; do not improvise the computations. Recipe 0 (shared fetch layer, changelog shape probe, priority-source rule) runs before any category.

SLA & Responsiveness

• Time-to-first-touch: created → first changelog entry or comment, per priority tier
• Time-to-resolution: created → terminal status transition, vs the P1-P5 SLA table (data/priority-framework.md)
• SLA breach rate per priority tier and per client
• Patch latency for vulnerability tickets: created → resolved, segmented by KEV-listed vs not

Flow & Backlog Health

• Status dwell time: changelog transitions → hours spent in each status; identifies the bottleneck state
• Cycle time distribution per issue type (median, p85)
• Net flow: created vs resolved per week — backlog growing or draining
• Aging WIP: open tickets bucketed by age (0-7d, 7-30d, 30-90d, >90d)
• Reopen rate: tickets with a transition out of a terminal status

Signal Quality & Noise

• Alert-storm detection: daily created counts, flag days >3σ above trailing mean
• Repeat-offender clusters: near-duplicate summaries/assets recurring → digest-ticket candidates
• False-positive burden: FP disposition share × measured per-ticket effort = hours/month spent on noise (uses /analyze-ticket-effort priors)
• Ticketing conversion: tickets ÷ upstream alerts (when a pipeline count is provided)

Workload & Distribution

• Assignee distribution: ticket counts and touch-session counts per analyst (SENSITIVE — aggregate for reports; never rank individuals in shared docs)
• After-hours share: sessions starting outside business hours
• Per-client mix shift: type-mix changes month over month

Process

1. Parse --period (default: 30d) and --category (default: all)
2. Artifacts pass: scan artifacts/enrichments/, artifacts/reviews/, artifacts/investigations/
3. Jira pass: Recipe 0 first (probe changelog shape, decide priority source, load priors); list-level metrics (net flow, aging, storms, workload counts) from cheap list queries; changelog-based metrics (dwell, first-touch, reopen, cycle time) via the background resumable fetch — reuse /tmp/effort_data/ from a prior effort run when fresh
4. Aggregate, compute trends (state R²; ranging rule: R² < 0.3 is not a trend)
5. Present summary with targets, breaches, and recommendations; save to artifacts/metrics/kpi-<period>-<date>.md
6. Client names, per-analyst figures, and rates stay in local artifacts — never in committed files or shared output without clearance

References

• ${CLAUDE_PLUGIN_ROOT}/data/jira-metrics-recipes.md — concrete recipe per Jira metric (READ FIRST for the Jira pass)
• ${CLAUDE_PLUGIN_ROOT}/data/priority-framework.md — P1-P5 SLA targets
• ${CLAUDE_PLUGIN_ROOT}/data/effort-analysis-method.md — fetch patterns, session method, trend rules
• ${CLAUDE_PLUGIN_ROOT}/templates/effort-priors-tmpl.yaml — local org parameters