County leadership asks for dwell time on last week's finance incident. An analyst reports the 40 minutes the notable was assigned. What is dwell time?
Select an answer to reveal the explanation.
Short Explanation
Dwell is how long the burglar had the run of the finance floor, not how long the analyst stared at the notable. Forty minutes of ticket time can hide two weeks of attacker time. Measure presence until eviction.
Full Explanation
Dwell time is the duration an adversary remained in the environment before eviction. It is not mean time an analyst held a notable, dashboard refresh interval, or idle time after close. Ticket handle time can be a contributor to MTTR but is the wrong definition of dwell. Civic leadership asking for dwell needs attacker-presence duration on the county network.