Containment time

As explained in Cyber Threat Hunting

Time to contain is the elapsed time between detection of a security incident and implementation of measures that limit its spread or impact.

Containment time is the elapsed time from detecting a security incident to implementing measures that limit its spread or impact. Mean or median time to contain (MTTC) gives security leaders a concise view of response performance and supports reporting to executive stakeholders and the CISO. section 12.5.1 section 12.5.2

Use containment time to organize operational reporting around:

• Major and high-severity incidents, including whether MTTC stayed within or exceeded the defined threshold. section 12.5.1
• Medium- and low-severity incidents, where a CISO dashboard can show time to contain alongside time to triage. section 12.5.2
• Detection channels such as threat monitoring, threat intelligence, and threat hunting, while retaining containment time as an operations metric. section 12.5.2

Dashboard view

A monthly executive dashboard can show MTTC for major and high-severity incidents, identify cases inside or outside the threshold, and display six-month incident trends. A CISO dashboard adds time to contain for medium- and low-severity incidents, time to triage, and the channel that uncovered each incident. section 12.5.1 section 12.5.2

Figure 12.2 Executive security operations dashboard showing high-level metrics and other high-level information

Use the executive security operations dashboard to compare containment performance with incident totals, severity, type, detection time, and threshold status. section 12.5.1

How Cyber Threat Hunting covers it

How deep it goes

Defines containment time as a metric and places it in dashboards, but does not provide calculation steps or response procedures.

Examples

Uses executive and CISO dashboards, threshold status, severity breakdowns, and detection-channel reporting as concrete metric contexts.

What you can do after

Evaluate security operations through MTTC or TTC trends, thresholds, severity views, and detection-channel breakdowns for executive or CISO reporting.

How it connects

Connects containment time with time to detect, time to triage, incident severity, detection channels, and threat hunting.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityThe average elapsed time required to contain a cybersecurity incident after it has been detected.

Compare how 2 books explain containment time →

Related concepts

• metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
• derived metrickind of · A derived metric is a metric calculated from a combination of other metrics or data over time.
• thresholdconfigured by · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.
• incident responsemeasures · Incident response is the organized process of detecting, managing, investigating, containing, and recovering from operational or security incidents.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.