County leadership asks for dwell time on last week's finance incident. An analyst reports the 40 minutes the notable was assigned. What is dwell time?
Select an answer to reveal the explanation.
Short Explanation
Dwell is how long the burglar had the run of the finance floor, not how long the analyst stared at the notable. Forty minutes of ticket time can hide two weeks of attacker time. Measure presence until eviction.
Full Explanation
Dwell time is how long the adversary remained in the environment before eviction—presence on the county network—not how long a notable sat assigned to an analyst on the Analyst Queue. Reporting the forty minutes of ticket assignment as dwell misstates the metric leadership asked for on last week's finance incident and understates true exposure if the attacker was present far longer. Treating assignment minutes as dwell regardless of attacker presence fails by concept because analyst queue handling time is a workflow metric, not adversary residency. Time from ticket close to the next coffee break on the shift fails by concept because it is irrelevant shift trivia, not a security KPI. Mean time between Enterprise Security dashboard refreshes fails by concept because UI refresh intervals measure console behavior, not how long finance systems were compromised. Exam caveat: SPLK-5001 distinguishes dwell (adversary presence until eviction) from MTTD, MTTR, and ticket-assignment duration; do not substitute queue time for dwell in civic leadership reports. Operational check: for the finance incident, compute dwell from earliest confirmed malicious activity to eviction using contributing events or investigation notes, and report assignment duration separately if leadership also wants queue handling time.