A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between…

Question

Options

• AMTTR (Mean Time to Respond)
• BMTBF (Mean Time Between Failures)
• CMTTA (Mean Time to Acknowledge)
• DMTTD (Mean Time to Detect)

• A
  90% (19)
• C
  5% (1)
• D
  5% (1)

Explanation

MTTR (Mean Time to Respond) measures the total time from when an alert is created to when it is resolved or closed - in this scenario, from the Risk Notable Event triggering to the analyst closing it as a false positive. This makes it the correct metric for the full incident lifecycle described.

Why the distractors are wrong:

• B. MTBF (Mean Time Between Failures) measures the average time between system failures/outages - it's an infrastructure reliability metric, not an alert-handling metric.
• C. MTTA (Mean Time to Acknowledge) only measures the time until an analyst first acknowledges the alert, not until they close it - it's a subset of the response window.
• D. MTTD (Mean Time to Detect) measures how long it takes to discover a threat or anomaly, occurring before the alert is even created, not after.

Memory tip: Think of the lifecycle in order - Detect → Acknowledge → Respond. MTTD ends when the alert fires, MTTA ends when someone opens it, and MTTR ends when it's done (resolved or closed). "R = Resolution" covers the whole race from start to finish.

No community discussion yet for this question.