Splunk
SPLK-5002 · Question #56
The following SPL is designed to report on a certain SOC metric. Which metric is the most likely topic for this report?
The correct answer is A. Mean time to Triage. The SPL calculates the time difference between create_time and triage_time for notable events. This directly measures how long it takes analysts to triage an alert after it is created, which is the definition of Mean Time to Triage (MTTT).
Advanced Threat Hunting and Analytics
Question
The following SPL is designed to report on a certain SOC metric. Which metric is the most likely topic for this report?
Exhibit
Options
- AMean time to Triage
- BMean time to Respond
- CMean time to Resolve
- DDwell Time
How the community answered
(61 responses)- A74% (45)
- B3% (2)
- C8% (5)
- D15% (9)
Explanation
The SPL calculates the time difference between create_time and triage_time for notable events. This directly measures how long it takes analysts to triage an alert after it is created, which is the definition of Mean Time to Triage (MTTT).
Topics
#SPL#MTTI#SOC metrics#notable triage
Community Discussion
No community discussion yet for this question.