Containment time
Containment time is the elapsed time between detecting a cybersecurity incident and implementing measures that limit its spread or impact.
Data-Driven Cybersecurity
The average elapsed time required to contain a cybersecurity incident after it has been detected.
- How it is used
- Tracks how quickly incident response limits an incident’s effects after detection.
- How deep it goes
- Defines the interval and its average, then interprets targets and before-and-after results without detailing a calculation procedure.
- Examples
- Uses risk dashboards, a one-hour containment target, and an eight-to-three-hour improvement after response changes.
- What you can do after
- Evaluate/understand whether containment is improving and where incident response processes may need attention.
Read how Data-Driven Cybersecurity explains containment time →
Cyber Threat Hunting
Time to contain is the elapsed time between detection of a security incident and implementation of measures that limit its spread or impact.
- How it is used
- Measures security-operation performance for executive and CISO reporting, including high-severity incidents and lower-severity detail.
- How deep it goes
- Defines containment time as a metric and places it in dashboards, but does not provide calculation steps or response procedures.
- Examples
- Uses executive and CISO dashboards, threshold status, severity breakdowns, and detection-channel reporting as concrete metric contexts.
- What you can do after
- Evaluate security operations through MTTC or TTC trends, thresholds, severity views, and detection-channel breakdowns for executive or CISO reporting.
Related concepts
- metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
- derived metrickind of · A derived metric is a metric calculated from a combination of other metrics or data over time.
- thresholdconfigured by · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.
- incident responsemeasures · Incident response is the organized process of detecting, managing, investigating, containing, and recovering from operational or security incidents.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.