Skip to content

How to Measure Alert Management Performance#

This topic provides step-by-step instructions for measuring alert management performance in TheHive.

You can measure alert management performance for all alerts in your organization or a specific case.

If you want to know more about the key performance indicators (KPIs) available in TheHive, refer to the About Key Performance Indicators topic.

Automated actions

If alerts are created or updated through automated actions (API, functions, or external services), some indicators may be identical or very close in value, especially if multiple operations occur within the same second.

Measure the performance of all alerts in your organization#

Required permissions for editing dashboards

Only users with the manageDashboard permission can edit dashboards in TheHive.

  1. Go to the Dashboards view from the sidebar menu.

    Measure case management performance

  2. Select a dashboard related to alerts.

  3. Select .

  4. Select Edit on the section where you want to add your alert management KPIs.

  5. Select any value that begins with timeTo to any Filters box.

Units

If the unit of an indicator is not explicitly mentioned, values are in milliseconds.

Measure the performance of a specific alert#

  1. Locate the case you want to check.

  2. In the alert description, move through the Time metrics section in the left pane.

    Alert description metrics

  3. Review the available indicators for your alert.

Next steps#