A SOC manager asks an analyst to show whether recent playbook improvements are making the team faster. The analyst has ticket timestamps, alert-generation times, and containment times. Which metric set should be reported to evaluate detection and resolution effectiveness?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a race clock: you need to know when the fire was first spotted and when it was finally out. MTTD and MTTR give you those two checkpoints, so you can tell if new playbooks actually speed the team up. If you only count closed tickets or false positives, you're measuring volume, not speed.
Full Explanation
MTTD and MTTR are operational clocks that answer whether the SOC is getting faster. MTTD is measured from the onset of malicious activity, approximated by the earliest evidence in SIEM or EDR telemetry, to the moment the team detects it. MTTR is measured from that detection to containment, eradication, and recovery. In a hybrid SOC, these values connect SIEM timestamps, EDR events, ticket acknowledgment, and containment status, letting a manager compare performance before and after playbook changes. A false positive rate and closed-ticket count can show alert quality and workload throughput, but not how quickly a real incident was found and stopped. Mean time between failures and patch success rate are reliability or maintenance measures; they may reduce incident volume yet do not measure response speed. Escalation percentage and shift utilization describe routing and staffing pressure, not elapsed time from alert creation to containment. Exam caveat: choose the metric that matches the requested outcome, because speed metrics and quality metrics are often mixed. Operational check: pull earliest-evidence, detection, and containment timestamps, then calculate average MTTD and MTTR by incident category.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.