CISO Assistant Analytics

CISO Assistant approaches analytics from two distinct angles: automated, real-time data-quality diagnostics available directly within the interface, and isolated technical metric syndication designed to power enterprise operational dashboards.1

1. Embedded Quality Analytics: The X-Rays Engine

Rather than relying on static, end-of-quarter spreadsheet reviews, CISO Assistant features an automated data-integrity analytics suite called X-Rays. This engine runs background calculations across the database to detect structural inconsistencies, grouping them into color-coded dashboards:1

• Errors (Red): Critical logical failures that invalidate your reporting. Examples include identifying risk scenarios where the Residual Risk level or impact score is calculated to be higher than the Current Risk level, or flagging an active control marked as an "existing mitigation" whose overall status is inactive.1

• Warnings (Yellow): Gaps in documentation and accountability. The engine scans for requirements marked "Compliant" that lack an uploaded file or URL reference, and highlights active risk acceptances that have no defined expiration date.1

• Info (Blue): General operational status insights, such as alerting teams when an assessment or threat model is still marked In Progress.1

The underlying calculations are executed directly via backend validation scripts (RiskAssessment.quality_check() and ComplianceAssessment.quality_check()) and can be programmatically queried using the REST endpoint: GET /api/perimeters/quality_check/.1

2. Operational Telemetry: The Prometheus Metrics Server

For organizations requiring live, macro-level infrastructure analytics and performance trends, CISO Assistant includes a standalone Prometheus Metrics Server.1

By launching the service tool from your terminal (python manage.py metrics_server), the platform spins up an isolated HTTP endpoint (by default on port 8001) that cleanly separates analytics ingestion from your core web application traffic.1

The server exposes live telemetry counters that track the growth and composition of your GRC program. Key metrics exposed for scraping include:1

• User Engagement: Total user profiles (ciso_assistant_nb_users) and first-time login counts (ciso_assistant_nb_first_login).1

• Inventory Distribution: Counts of active Domains (ciso_assistant_nb_domains), scoped Perimeters (ciso_assistant_nb_perimeters), and technical or business Assets (ciso_assistant_nb_assets).1

• Security Posture Data: Active compliance assessments (ciso_assistant_nb_compliance_assessments), modeled threat scenarios (ciso_assistant_nb_risk_scenarios), active controls (ciso_assistant_nb_measures), and signed-off exceptions (ciso_assistant_nb_risk_acceptances).1

• System Integrity: Instance creation timestamps, last login tracking, and build version metadata (ciso_assistant_build_info).1

These endpoints allow security teams to hook CISO Assistant's real-time posture directly into visualization suites like Grafana, providing corporate leadership with live compliance dashboards.1