The municipal SOC defines MTTR as starting at detection and ending…

Question

The municipal SOC defines MTTR as starting at detection and ending when the threat is contained. A parks kiosk sat undetected for six days and was then isolated in 45 minutes. Which statement about MTTR is correct?

Accepted Answer

MTTR is the post-detection response time, so this incident's MTTR is the 45 minutes to isolate—not the six-day blind period. — They spotted it and had the kiosk isolated in 45 minutes—that is MTTR under the city's definition. The six days of blindness is MTTD (and it inflates dwell). Do not mash those clocks into one number.

Answer

MTTR includes the six undetected days because dwell and MTTR are identical.

Answer

MTTR is only the time until the help desk first hears a clerk complaint.

Answer

MTTR starts at first adversary access, before any detection.

The municipal SOC defines MTTR as starting at detection and ending when the threat is contained. A parks kiosk sat undetected for six days and was then isolated in 45 minutes. Which statement about MTTR is correct?

Short Explanation

Full Explanation