Security Incident Count
Security Incident Count: Number of security incidents in a period.
Computable definition
The canonical formula in the GASP formula grammar. The MCP server compiles it to SQL over the datasets listed below.
count_distinct(field.incident_id where field.incident_type = 'security')Unit: count
Data requirements
Grain: Per event · Frequency: Per incident · Aggregation: event · Staged: no · Main source: Incident Management.
| Field | Dataset | Type |
|---|---|---|
incident_id | incident | string |
incident_type | incident | string |
started_at | incident | timestamp |
Example SQL (Postgres)
SELECT (SELECT COUNT(DISTINCT incident_id) FROM incident WHERE started_at >= :period_start AND started_at < (:period_end + INTERVAL '1 day') AND incident_type = 'security') AS security_incident_count From an agent: with the GASP MCP server, call
lookup_metric({ "name": "Security Incident Count" }) or generate_query({ "metric": "Security Incident Count", "adapter": "<your adapter JSON>" }).