Executive dashboard

As explained in Cyber Threat Hunting

An executive dashboard is a visual reporting interface that summarizes high-level operational metrics, trends, and significant events for organizational leaders.

An executive dashboard summarizes security operations for organizational leaders through high-value metrics, incident patterns, and significant updates. It supports concise reporting to the CEO, COO, CFO, CIO, and executive security committees. section 12.5.1

A practical dashboard can show:

• Total incidents and breakdowns by severity and type. section 12.5.1
• Mean or median time to detect (MTTD) and contain (MTTC) major and high-severity incidents, including threshold performance. section 12.5.1
• Six-month trends for major, high, and medium incidents. section 12.5.1
• High-level incident summaries that clarify what happened, why it happened, delayed detection, and response timing. section 12.5.1

Figure 12.2 Executive security operations dashboard showing high-level metrics and other high-level information

Use the dashboard view to compare current incident volume, severity, detection, containment, and historical trends at a glance. section 12.5.1

How Cyber Threat Hunting covers it

How deep it goes

Defines dashboard contents and reporting context but stops short of implementation instructions or dashboard construction.

Examples

Uses a monthly incident dashboard, six-month severity trends, threshold comparisons, and a major-incident executive summary.

What it assumes

Assumes familiarity with security incidents, security operations, and high-value operational metrics.

What you can do after

Evaluate security-operation status and communicate incident performance and significant events at executive level.

How it connects

Connects security metrics with MTTD, MTTC, security incidents, threat hunting, and incident response.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• containment timeuses · Containment time is the elapsed time between detecting a cybersecurity incident and implementing measures that limit its spread or impact.
• mean time to detectuses · Mean time to detect is the average elapsed time between the occurrence of an incident or failure and its identification.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.