A security operations center wants to measure how long it takes from when a threat is first observed in the environment to when it is fully remediated. Which metric does this describe?
Select an answer to reveal the explanation.
Short Explanation
You want MTTR because it measures the average time from detection through the full incident response and remediation process to resolution. MTTD only tells you how long it took to notice the threat, not how long it took to fix it.
Full Explanation
Mean Time to Respond (MTTR) is correct because it measures the average time from alert/detection through the full incident response and remediation process to resolution. Mean Time to Detect (MTTD) is wrong because it measures only the detection phase — how long before the threat is noticed. False Positive Rate (FPR) is wrong because it's a detection accuracy metric, not a response time metric. Mean Time Between Failures (MTBF) is wrong because it's a reliability engineering metric for hardware or service uptime, not a security operations metric.