A metric definition is the written specification of exactly how a metric is computed. Not a description of what it means. A specification precise enough that two people working independently produce the same number.
That last test sounds trivial. Very few security metrics in production would pass it.
The numerator, stated as a population with its inclusion rules.
The denominator, stated the same way, with exclusions listed explicitly and each exclusion justified.
The time grain, and whether the value is a point-in-time reading or a period aggregate. See time grain.
The timezone, which matters more than people expect for anything measured daily.
The source systems, and what happens when one of them is unavailable for a period.
The handling of edge cases. Assets that appeared mid-period. Records with missing fields. Entities in scope for part of the window.
The unit and the direction of good.
The version, and the date it took effect.
Take any metric currently in your reporting pack. Hand the definition to someone competent who did not build it, give them access to the sources, and ask for the number.
The gap between their figure and yours is the part of the definition that was living in somebody’s head.
That gap is where definition drift enters. Anything undocumented gets re-decided each time the metric is produced, and re-decided differently once the person changes.
Exclusions cause more trouble than any other element, because they are added quietly and rarely removed.
A noisy subnet gets filtered out during a migration. Accepted risks get dropped from the denominator to make a chart readable. A newly acquired business is left out until its data is clean.
Each one is defensible at the time. None of them get written down. Two years later the metric covers a population nobody could describe, and the improvement it shows is partly the accumulation of exclusions.
Metric Maestro holds each definition centrally and versions it. The formula lives in the platform rather than in a query written against a vendor API, so replacing a source tool changes the mapping underneath and leaves the definition intact.
Every stored value records the definition version it was computed under. When a definition changes, the change is dated and the affected series is marked, which makes the history interpretable instead of merely continuous.
From the blog