The county wants time-in-status numbers that feed MTTR. An IT manager orders a new ITSM tool because Splunk cannot time a notable. Where should the municipal SOC measure that?
Select an answer to reveal the explanation.
Short Explanation
You do not buy a second stopwatch to time a race Splunk already timed. Incident Review Audit and the Analyst Queue stamp when a notable moved status. That time-in-status is a real contributor to MTTR.
Full Explanation
Enterprise Security records notable workflow timestamps on the Analyst Queue and exposes them through Incident Review Audit and related reporting. Those times are the native source for time-in-status that contributes to MTTR. Risk Analysis inspects risk objects and contributing risk; it is not the ticket-close dashboard. Paper runbooks and endpoint event logs are not the ES queue clock.