# Record metric-chart granularity when comparing an Azure incident timeline

> Keep chart aggregation intervals visible in incident evidence.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:51+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Keep chart aggregation intervals visible in incident evidence.

## Potentially affected

Use this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.

## DSE recommendation

DSE recommends agreeing on a common chart configuration for the investigation.

## Article

## Source facts

Microsoft’s metrics-explorer example uses 48 aggregated points for a 24-hour chart at 30-minute granularity and 96 points at 15-minute granularity. In its response-time example, each point averages the captured requests within the relevant interval. The plotted points therefore represent interval aggregates. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics).

## Applicability

Use this review when responders compare exported charts or screenshots of the same incident. Record the resource, metric, aggregation, time range, timezone and granularity for each view. Treat an unexplained visual difference as a question to investigate before changing the incident timeline.

## DSE recommendation

DSE recommends agreeing on a common chart configuration for the investigation. Preserve the original views, then create comparable views using the same interval and aggregation. Ask the service owner which duration of degradation matters to the application so the chosen display supports that question. Avoid presenting an unlabeled screenshot as a complete measurement record.

## Verification

Recreate the chart with both selected granularities and record the resulting configuration with each image. Compare a known interval with the measurements available for that interval. Note where the display merges requests into one point. Keep the chart settings alongside any narrative conclusion so another reviewer can reproduce the comparison.

## Official references

[Microsoft Learn: Analyze metrics with Azure Monitor metrics explorer](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics).

## Primary reference

- Name: Analyze metrics with Azure Monitor metrics explorer - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/analyze-metrics
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Record metric-chart granularity when comparing an Azure incident timeline,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-009-record-metric-chart-granularity-when-comparing-an-azure-incident-timeline/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.