How do you analyze security and compliance data in Metabase?
Security and compliance tools hold the operational record of your security program: vulnerability findings, detections, control results, auth events, and asset inventory. In Metabase, bring summaries of those signals into a SQL database and model adjacent layers for vulnerability findings, detections, control results, and auth-event rollups. Those layers support dashboards for open exposure, remediation velocity, SLA compliance, detection response, audit readiness, and identity hygiene — the cross-tool view for the CISO and the board that no single vendor console covers.
TL;DR — Never sync raw security telemetry into a BI warehouse. Sync findings, detections at alert grain, daily control-result snapshots, daily auth-event rollups, and asset inventory. MCP is useful for live exploration; durable posture reporting needs database-backed syncs and history.
Which tools does this cover?
- SonarQube — issues (findings), security hotspots, projects, quality gates
- Tenable — vulnerability findings, assets, scans, plugins
- Okta — system log events, users, applications, groups
- CrowdStrike — detections (alerts), incidents, hosts and sensors, Spotlight vulnerabilities
- Snyk — issues (vulnerabilities), projects, targets, organizations
- Wiz — issues (toxic risk combinations), vulnerability findings, cloud resources, projects
- Auth0 — log events (authentication events), users, applications, connections
- SentinelOne — threats (detections), agents (endpoints), sites, mitigations
- Semgrep — findings, rules, projects (repos), policies
- Vanta — control tests, controls, frameworks, policies
- Drata — monitoring test results, controls, frameworks, personnel
- HackerOne — reports, programs, weaknesses (CWE), bounties
- Bugcrowd — submissions, programs (engagements), targets, rewards
- Orca Security — alerts (risk findings), assets, vulnerabilities, compliance results
For adjacent signals, cross-link the shared model to Cloudflare (edge security events) and your HR system — BambooHR departure dates joined to Okta records power the deprovisioning-lag audit.
What is the shared security data model?
| Concept | Common terms | Used for |
|---|---|---|
| Vulnerability finding | Finding, issue, vulnerability, alert | Open criticals, remediation time, SLA compliance |
| Detection | Detection, alert, threat, signal | Detection volume, MTTD, triage speed |
| Security incident | Incident, case, investigation | Incident count and response trends |
| Control result | Control, test, monitor, check | Control pass rate, audit readiness |
| Auth event rollup | Login, sign-in, authentication event per day | Failed-login rate, MFA adoption |
| Asset | Host, resource, endpoint, repository | Scan coverage and the join key for findings |
| Identity | User, account, service account | MFA adoption, lifecycle hygiene |
| Report / submission | Bug bounty report, disclosure, submission | Program inflow, triage SLA, bounty spend |
How do you connect security tools to Metabase?
- MCP + CLI route — pull a scoped, summarized export through an MCP server, save CSV, and load it with
mb upload csvfor fast exploration. - Pipeline route — sync findings, snapshots, and metadata into a database or warehouse with a connector or API pipeline, then build durable dashboards. Note that managed ELT coverage is thin in this category — most tools need API scripts or native exports.
- Cross-source route — join security data to assets, HR records, ticketing, and business data to explain risk, not just count it.
What can you analyze across these tools?
- Open critical vulnerabilities — deduplicated open criticals across scanners
- Mean time to remediate — first-seen to resolved, as a median by severity
- Vulnerability SLA compliance — findings closed within their severity SLA
- Mean time to detect — first activity to detection, honestly caveated
- Control pass rate — passing controls per framework, snapshot daily
- MFA adoption rate — strong second factors across active humans
- Failed login rate — auth friction and attack signal, separated
- Scan coverage — scanned assets over the true inventory
Which dashboards should you build?
- Vulnerability management — open exposure, remediation velocity, and SLA compliance
- Incident response trends — detection volume, triage speed, and MTTD
- Compliance posture — control pass rates, failing controls, and audit readiness
- Identity & access analytics — auth health, MFA adoption, and lifecycle hygiene
- AppSec findings — SAST, SCA, and bug-bounty findings across the SDLC
- Attack surface coverage— whether everything is actually scanned and protected
Common mistakes
Syncing raw security telemetry into the warehouse.→ EDR telemetry and auth-log firehoses belong in a SIEM or security data lake. The warehouse gets findings, rollups, and snapshots.
Counting per-scan rows instead of deduplicated findings.→ The same CVE on the same asset shows up in every scan and every scanner. Deduplicate on a canonical finding key in a modeled layer.
Reporting posture without snapshot history.→ Security tools report current state. Daily snapshots are what turn "87% pass today" into a trend leadership can act on.
Reporting response durations as means.→ Remediation and triage times are heavily right-skewed — report medians and p90.
Trusting the scanner's own inventory as the coverage denominator.→ A scanner can only report the assets it knows about. Reconcile coverage against cloud APIs and your CMDB.
Related
Analytics
Integrations
FAQ
What is security and compliance analytics?
Security and compliance analytics is reporting built on the operational record of your security program — vulnerability findings, detections, control results, and identity events — synced as summaries into a SQL database and analyzed in Metabase. Instead of live triage, it answers longitudinal questions: is exposure shrinking, are we remediating within SLA, and would we pass the audit today? See the security analytics overview for the full build, and mean time to remediate and control pass rate for the core metrics.
Does Metabase connect natively to Tenable, CrowdStrike, or Okta?
No — Metabase reads SQL databases and warehouses, not SaaS APIs. Sync each tool's findings and metadata into a database first with a connector or API pipeline, then point Metabase at that database. For a quick first pass, pull a summarized export and load it with the Metabase CLI (
mb upload csv). Each tool guide — Tenable, CrowdStrike, Okta — documents both routes.Why build security dashboards outside the vendor consoles?
Because every console reports its own slice, and the questions leadership asks span all of them: total open criticals across scanner, cloud, and code; remediation velocity by team; MFA adoption next to control pass rate. A warehouse-backed vulnerability management dashboard gives the CISO and the board one governed view — without buying every stakeholder a seat in every security tool.
How much security data should I sync into a warehouse?
As little as answers the question. Findings, detections at alert grain, daily control-result snapshots, daily auth-event rollups, and asset inventory cover nearly every reporting need — from compliance posture to attack surface coverage. Never sync raw EDR telemetry or the auth-log firehose: storage explodes, queries crawl, and your SIEM or security data lake already stores those signals better.
Can I combine findings from multiple scanners?
Yes — that's the point of the shared model. Normalize severities to one scale, build a canonical finding key (asset + CVE or rule + source), and deduplicate in a modeled layer. Then open critical vulnerabilities means the same thing whether the finding came from Tenable, Wiz, or Snyk, and cross-scanner double-counting stops inflating the number.
Which tools does the security and compliance category cover?
Fourteen tools across four groups: vulnerability and exposure management (Tenable, Wiz, Orca Security), application security (SonarQube, Snyk, Semgrep, HackerOne, Bugcrowd), endpoint detection and response (CrowdStrike, SentinelOne), identity (Okta, Auth0), and compliance automation (Vanta, Drata). All of them map onto the same shared model, so the dashboards work regardless of which tools you run.
Which dashboards should you build first from security data?
Start with vulnerability management — it needs only a findings table with lifecycle timestamps. Add compliance posture once daily control snapshots land, then identity and access analytics from auth-event rollups. Incident response trends, AppSec findings, and attack surface coverage round out the set as detection, code-scanning, and inventory data arrive.