Splunk
SPLK-5001 · Question #106
The Security Operations team would like to track improvements after customizing dashboards to help analysts triage security alerts more efficiently. Which metric would they use?
The correct answer is A. Mean Time to Detect. By customizing dashboards to streamline alert triage, you shorten the interval between an alert’s occurrence and its identification by analysts - exactly what Mean Time to Detect measures.
Incident Investigation and Response
Question
The Security Operations team would like to track improvements after customizing dashboards to help analysts triage security alerts more efficiently. Which metric would they use?
Options
- AMean Time to Detect
- BRecovery Time
- CDwell Time
- DMean Time to Respond
How the community answered
(38 responses)- A95% (36)
- C3% (1)
- D3% (1)
Explanation
By customizing dashboards to streamline alert triage, you shorten the interval between an alert’s occurrence and its identification by analysts - exactly what Mean Time to Detect measures.
Topics
#MTTD#SOC metrics#mean time to detect#triage efficiency
Community Discussion
No community discussion yet for this question.