What does the SOC metric MTTC provide in incident analysis?

MTTC stands for Mean Time To Contain. This metric specifically measures the average time it takes for a Security Operations Center (SOC) team to both recognize an incident and then effectively contain it, meaning stopping its spread and preventing further damage or impact to the systems and data. It's a key indicator of the efficiency of an organization's incident response capabilities.

The average time it takes to fix the issues caused by the incident is typically related to Mean Time To Resolve (MTTR) or Mean Time To Repair, which happens after containment.

The average time it takes to detect that the incident has occurred is known as Mean Time To Detect (MTTD), a different SOC metric.

The average time the attacker has access to the environment is often referred to as 'dwell time' and is a measure of attacker presence, not an SOC containment metric.