The SOC manager has a desire to measure mean time to acknowledge findings (notable events) in order to meet a desired service level objective. Which two fields can be used to measure this metric?

The correct answer is B. Status, Owner. Mean Time to Acknowledge (MTTA) can be measured using the Status and Owner fields. Status indicates when a notable event moves from a new or unacknowledged state, and Owner identifies which analyst acknowledged the event, allowing calculation of the time taken to

Advanced Threat Hunting and Analytics

Question

Options

ASeverity, Owner
BStatus, Owner
CUser, Status
DUrgency, Status

How the community answered

(22 responses)

A
9% (2)
B
82% (18)
C
5% (1)
D
5% (1)

Explanation

Mean Time to Acknowledge (MTTA) can be measured using the Status and Owner fields. Status indicates when a notable event moves from a new or unacknowledged state, and Owner identifies which analyst acknowledged the event, allowing calculation of the time taken to

Topics

#MTTA#SLO#notable events#SOC metrics

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice