> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Analytics

> Incident metrics, MTTR trends, agent performance, and cost

The Analytics page (`/analytics`) gives you a data-driven view of how your incident operations are performing over time. It is organized into five tabs — each tab loads its data independently so the page opens fast regardless of which tab you need.

Use the date range picker at the top to change the reporting window. Preset options (7 days, 14 days, 30 days, 90 days) are available alongside a custom date range. Every tab respects the same window.

All data is scoped to your selected environment. To view analytics across a different environment, change the context switcher in the sidebar.

You can export the underlying data as CSV or JSON using the **Export** button in the top-right corner.

## Overview tab

The Overview tab is the default landing surface. It focuses on business-outcome signals: are you resolving incidents quickly, and is the rate improving?

**8 KPI cards:**

* Total incidents created
* Incidents resolved
* Incidents closed
* Average MTTR (mean time to resolution) with a trend arrow vs. the prior period
* P1 incident count
* P2 incident count
* Avg time to first agent action
* Overall success rate (incidents resolved without human takeover)

**Incident trend chart** — a day-by-day line chart showing incidents created vs. incidents resolved for the selected window. A growing gap between created and resolved is a signal that your team is falling behind.

**MTTR by severity** — a bar chart breaking down average resolution time by severity level (P1–P4). P1 MTTR is the most operationally significant number here.

**Severity distribution** — a breakdown of what proportion of incidents were P1, P2, P3, and P4 over the period.

## Operations tab

The Operations tab surfaces the mechanics of how incidents moved through the lifecycle — where time was spent, what stopped them, and who was involved.

**Phase time chart** — average time spent in each lifecycle stage (detection, triage, diagnosis, resolution, verification, closure). Use this to identify bottlenecks: if diagnosis is consistently the longest phase, that is a signal to improve runbook coverage or telemetry quality.

**Root causes** — a breakdown of the most common root cause categories across resolved incidents in the period.

**Control mode chart** — the proportion of incidents handled in Autonomous vs. Guided mode.

**Control transfer** — how often human intervention was triggered (including voluntary human takeovers), and at which stage.

**Actor distribution** — the split between AI agent actions and human actions across the period.

## AI & Agents tab

The AI & Agents tab is the default landing surface for users in the Commander role. It focuses on how well the AI agents are performing — accuracy, recommendation outcomes, and approval latency.

**AI confidence distribution** — a histogram of agent confidence scores at the point of recommendation. A distribution skewed toward high confidence (80–100%) indicates the agents are working with good telemetry and runbook coverage.

**Recommendation outcomes** — of all recommendations generated, what percentage were approved and executed vs. rejected vs. expired without action.

**Agent performance table** — a per-agent breakdown (Incident Commander, Diagnosis Specialist, Resolution Specialist, Verification Specialist) showing average response time, tasks completed, and error rate.

**Approval response time** — how long it takes your team to respond to HITL approval requests, broken down by severity. Long approval delays on P1 incidents are a signal to review your on-call escalation paths.

**Verification stats** — the proportion of incidents where metric verification confirmed full recovery vs. partial recovery vs. no recovery detected.

**AI feedback summary** — an aggregate view of the thumbs-up / thumbs-down feedback your team has submitted on agent outputs.

## Problems tab

The Problems tab gives you a health check on your problem-management backlog and the quality of your alerting. Data on this tab is org-scoped (not date-ranged).

**Problem intelligence** — open problems, problems resolved in the period, average time to resolution for problems, and recurrence rate.

**Alert intelligence** — total alerts received, alert-to-incident conversion rate, and alerts that were deduplicated.

**Aging and recurrence** — a breakdown of open problems by age (how long they have been open) and recurrence count (how many times the root cause has reoccurred).

**Detection source mix** — what proportion of incidents were detected via webhook alert vs. proactive detection vs. manual creation.

**Monitors added** — how many new monitoring rules were proposed and added to your environment from problem action items in the period.

## Cost tab

The Cost tab shows LLM spend for your organization. It is visible only to users with administrator or owner roles.

<Note>
  The Cost tab is only relevant for organizations using bring-your-own-key AI billing. It is hidden for environments where AI is managed by sureops.
</Note>

**Spend KPIs** — total spend for the period, average cost per incident, average cost per LLM call, and total call count.

**Budget status** — whether you are within your configured monthly budget, approaching the limit, or over budget.

**Spend trend** — a daily line chart of LLM spend over the period.

**Spend by stage** — a bar chart showing which lifecycle stages drive the most LLM cost. Diagnosis is typically the most expensive stage.

**Spend by model** — a table breaking down calls, tokens, and cost by AI model used.

**Top expensive incidents** — the 10 incidents that consumed the most LLM budget in the period, with links to their Incident Hubs.