Investigate security metrics

  • Article

Security metrics in Microsoft Security Exposure Management measure security exposure for a specific scope of assets or resources within a security initiative. Most security initiatives (but not all) have metrics associated with them.

Security Exposure Management is currently in public preview.

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

Prerequisites

  • Learn about security metrics.
  • Review permissions and prerequisites needed for working with Security Exposure Management.
  • Note possible preview issues:
    • Some instances of affected assets information (largely information originating in Secure score) don't appear on the Affected Items tab in an individual metric.
    • Some critical asset information for assets in the Affected Items tab doesn't show.
    • Asset details are calculated on demand.
    • Cloud-related metrics are only available if Microsoft Defender for Cloud is available in the subscription, and the Defender Cloud Security Posture Management (CSPM) plan is enabled.
    • In some cases, metrics are more specific than the scope of the related recommendations. In this case, the asset detail shown doesn't align with the asset details of the related recommendations.
    • If you remove a workload, you can't refresh the metric status and the asset details for the workload's related metrics.

Review security metrics

  1. In the Microsoft Defender portal, select Exposure management -> Exposure insights ->Metrics to open the Metrics page.

    Screenshot of the metrics page in Microsoft Security Exposure management.

  2. Select the metric you want to review.

  3. Review the metric properties.

    • Description: Metric description.
    • State: Current state of metric.
    • Last state update: The last time metric state was updated.
    • Current value: Current exposure score from significant to no/low exposure.
    • Affected items. The number of affected items in the total items.
    • Weight: Metric weight or maximum metric score possible.
    • Score impact: Possible score gain.
    • Security recommendations: Recommendations associated with the metric.

Edit the metric value

You can customize metric values for your business needed.

  1. To edit the metric value, select a specific metric.
  2. In the metric properties page, select weight, change the value, and apply.
  3. To accept the risk described by the metric, set the weight to zero.

Next steps