How Can I Calculate/Measure 'Mean Time To Contain' a Security Incident in Security Incident Response?
Dear ServiceNow Community Colleagues
I have been asked by a client to calculate, measure and show on a Performance Analytics Dashboard, the 'Mean Time to Contain' a Security Incident, in the Security Incident Response module.
Please kindly provide guidance on the metrics and calculation, the automated / formula indicators and most importantly, what is the Script I need to use, to calculate 'Mean Time to Contain' an SIR (on the Security Incident table) - being the time elapsed, between creation of the Security Incident and when it is updated to 'Contain' state (Lifecycle Stage).?
In the Performance Analytics Dashboard, I need to be able to show/present this metric/statistic going back historically for a period of one year. So I need to calculate and show the 'Mean Time to Contain' for Security Incidents, (monthly average), over the period of the last year.
Thanks very much as always, for any guidance & advice on how to achieve this.
