Leadership wants lower dwell on the county network and proposes buying more wall screens for the SOC. What actually moves dwell?
Select an answer to reveal the explanation.
Short Explanation
Dwell is not a TV problem. It shrinks when you notice faster and kick the adversary out faster—MTTD plus MTTR—with detections and Asset and Identity that tell you the host matters. Extra wall screens without that are expensive wallpaper.
Full Explanation
Dwell on the county network shrinks when the city notices faster and evicts faster—lower MTTD plus lower MTTR—supported by better detections and Asset and Identity context that speeds triage of who owns which host. Buying more wall screens for the SOC alone does not move dwell. Treating more screens as the dwell metric fails by concept because displays do not detect adversaries or contain them; they only show what analytics already know. Claiming only MTTR matters because dwell ignores how long the attacker was unseen fails by concept because unseen time is core to dwell and is driven by MTTD. Disabling Asset and Identity so analysts are not slowed by enrichment fails by concept because A&I context usually shortens investigation time; removing it tends to lengthen MTTR and thus lengthen dwell. Exam caveat: SPLK-5001 links dwell improvement to detection quality, response quality, and enrichment—not to SOC aesthetics or stripping Asset and Identity. Operational check: track MTTD and MTTR for county incidents, verify Asset and Identity enrichment on critical systems, and invest in correlation-search coverage rather than additional wall screens as the primary dwell reduction initiative.