{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "slug": "dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline", "url": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/" }, "title": "Record metric-chart granularity when comparing an Azure incident timeline", "summary": "Keep chart aggregation intervals visible in incident evidence.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:51+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 204, "potentially_affected": "Use this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.", "dse_recommendation": "DSE recommends agreeing on a common chart configuration for the investigation.", "primary_source": { "name": "Analyze metrics with Azure Monitor metrics explorer - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s metrics-explorer example uses 48 aggregated points for a 24-hour chart at 30-minute granularity and 96 points at 15-minute granularity. In its response-time example, each point averages the captured requests within the relevant interval. The plotted points therefore represent interval aggregates. Microsoft Learn.

\n

Applicability

\n

Use this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.

\n

DSE recommendation

\n

DSE recommends agreeing on a common chart configuration for the investigation. Preserve the original views, then create comparable views using the same interval and aggregation. Ask the service owner which duration of degradation matters to the application so the chosen display supports that question. Avoid presenting an unlabeled screenshot as a complete measurement record.

\n

Verification

\n

Recreate the chart with both selected granularities and record the resulting configuration with each image. Compare a known interval with the measurements available for that interval. Note where the display merges requests into one point. Keep the chart settings alongside any narrative conclusion so another reviewer can reproduce the comparison.

\n

Official references

\n

Microsoft Learn: Analyze metrics with Azure Monitor metrics explorer.

", "content_text": "Source facts\nMicrosoft’s metrics-explorer example uses 48 aggregated points for a 24-hour chart at 30-minute granularity and 96 points at 15-minute granularity. In its response-time example, each point averages the captured requests within the relevant interval. The plotted points therefore represent interval aggregates. Microsoft Learn.\nApplicability\nUse this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.\nDSE recommendation\nDSE recommends agreeing on a common chart configuration for the investigation. Preserve the original views, then create comparable views using the same interval and aggregation. Ask the service owner which duration of degradation matters to the application so the chosen display supports that question. Avoid presenting an unlabeled screenshot as a complete measurement record.\nVerification\nRecreate the chart with both selected granularities and record the resulting configuration with each image. Compare a known interval with the measurements available for that interval. Note where the display merges requests into one point. Keep the chart settings alongside any narrative conclusion so another reviewer can reproduce the comparison.\nOfficial references\nMicrosoft Learn: Analyze metrics with Azure Monitor metrics explorer.", "content_markdown": "## Source facts\n\nMicrosoft’s metrics-explorer example uses 48 aggregated points for a 24-hour chart at 30-minute granularity and 96 points at 15-minute granularity. In its response-time example, each point averages the captured requests within the relevant interval. The plotted points therefore represent interval aggregates. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics).\n\n## Applicability\n\nUse this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.\n\n## DSE recommendation\n\nDSE recommends agreeing on a common chart configuration for the investigation. Preserve the original views, then create comparable views using the same interval and aggregation. Ask the service owner which duration of degradation matters to the application so the chosen display supports that question. Avoid presenting an unlabeled screenshot as a complete measurement record.\n\n## Verification\n\nRecreate the chart with both selected granularities and record the resulting configuration with each image. Compare a known interval with the measurements available for that interval. Note where the display merges requests into one point. Keep the chart settings alongside any narrative conclusion so another reviewer can reproduce the comparison.\n\n## Official references\n\n[Microsoft Learn: Analyze metrics with Azure Monitor metrics explorer](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "url": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Record metric-chart granularity when comparing an Azure incident timeline", "item": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "url": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/", "headline": "Record metric-chart granularity when comparing an Azure incident timeline", "description": "Keep chart aggregation intervals visible in incident evidence.", "abstract": "Keep chart aggregation intervals visible in incident evidence.", "articleBody": "Source facts\nMicrosoft’s metrics-explorer example uses 48 aggregated points for a 24-hour chart at 30-minute granularity and 96 points at 15-minute granularity. In its response-time example, each point averages the captured requests within the relevant interval. The plotted points therefore represent interval aggregates. Microsoft Learn.\nApplicability\nUse this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.\nDSE recommendation\nDSE recommends agreeing on a common chart configuration for the investigation. Preserve the original views, then create comparable views using the same interval and aggregation. Ask the service owner which duration of degradation matters to the application so the chosen display supports that question. Avoid presenting an unlabeled screenshot as a complete measurement record.\nVerification\nRecreate the chart with both selected granularities and record the resulting configuration with each image. Compare a known interval with the measurements available for that interval. Note where the display merges requests into one point. Keep the chart settings alongside any narrative conclusion so another reviewer can reproduce the comparison.\nOfficial references\nMicrosoft Learn: Analyze metrics with Azure Monitor metrics explorer.", "datePublished": "2026-09-17T16:34:51+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Record metric-chart granularity when comparing an Azure incident timeline" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 204, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Analyze metrics with Azure Monitor metrics explorer - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics" } } ] } }