Analytics & MTTR

The Analytics API provides operational metrics across your Sentinel deployment — incident volumes, response time breakdowns, action counts, and MTTR (Mean Time to Respond) compared against industry benchmarks.

Summary

bash

GET /v1/sentinel/analytics/summary?days=30

Name	Type	Required	Description
days	integer	No	Lookback window in days (1–90). Defaults to 30.

json

{
  "data": {
    "period_days": 30,
    "since": "2025-05-02T00:00:00Z",
    "incidents": {
      "total": 47,
      "by_severity": {
        "critical": 3,
        "high": 12,
        "medium": 24,
        "low": 8
      },
      "by_status": {
        "resolved": 41,
        "contained": 4,
        "open": 2
      },
      "avg_response_time_seconds": 38
    },
    "actions": {
      "total": 183,
      "by_type": {
        "isolate_device": 12,
        "revoke_sessions": 34,
        "block_ip": 47,
        "run_scan": 64,
        "disable_account": 8,
        "quarantine_file": 18
      }
    },
    "network_blocks_active": 94
  }
}

MTTR breakdown

bash

GET /v1/sentinel/analytics/mttr?days=30

json

{
  "data": {
    "period_days": 30,
    "overall_avg_seconds": 38,
    "overall_avg_human": "38s",
    "industry_benchmark_seconds": 10800,
    "improvement_factor": 284,
    "by_severity": {
      "critical": {
        "count": 3,
        "avg_seconds": 22,
        "min_seconds": 18,
        "max_seconds": 31
      },
      "high": {
        "count": 12,
        "avg_seconds": 35,
        "min_seconds": 19,
        "max_seconds": 58
      }
    }
  }
}

Using analytics in reports

Combine the summary and MTTR endpoints to build executive-level security reports. Common patterns:

typescript

// Monthly security posture report
const [summary, mttr] = await Promise.all([
  fetch('/v1/sentinel/analytics/summary?days=30').then(r => r.json()),
  fetch('/v1/sentinel/analytics/mttr?days=30').then(r => r.json()),
])

const report = {
  period: '30 days',
  incidents_detected: summary.data.incidents.total,
  critical_incidents: summary.data.incidents.by_severity.critical,
  avg_response_time: mttr.data.overall_avg_human,
  vs_industry: `${mttr.data.improvement_factor}× faster than industry average`,
  active_blocks: summary.data.network_blocks_active,
}

Tip:Schedule a weekly analytics pull using the api.changelog.published webhook pattern — or use a cron job against the analytics endpoints — to feed security KPIs into your dashboards, board reports, or customer-facing portals.

Incidents Reference: Errors