To estimate dwell on a utilities risk object, the analyst needs when activity began. What timestamp should they take from the contributing events?
Select an answer to reveal the explanation.
Short Explanation
Dwell starts when the adversary first left a chip, not when the score looked scary. Grab the earliest contributing-event clock on that risk object. Do not confuse first(_time) on newest-first rows with the true start.
Full Explanation
Dwell estimates depend on the earliest evidence of adversary presence. In an RBA investigation that evidence is the earliest contributing-event timestamp on the risk object, obtained with min(_time) or earliest(_time). first(_time) matches that earliest time only when events are ordered oldest-first; default newest-first search order makes first(_time) the latest stamp. Peak-score time, queue-open time, and search schedule do not mark when activity began.