Mean time to detect

As explained in Cyber Threat Hunting

Time to detect is the elapsed time between the occurrence or initiation of a security event and its detection.

Mean time to detect measures the elapsed time between a security event occurring or beginning and its detection. It gives security leaders a concise view of monitoring performance and exposure before response begins. section 12.5.1

Use MTTD to:

• Report detection performance for major and high-severity incidents against defined thresholds. section 12.5.1
• Compare detection trends with incident counts and severity over recent months. section 12.5.1
• Frame questions about delayed discovery, including why an event was not detected earlier. section 12.5.1

Executive security dashboard

A monthly dashboard can show MTTD for major and high-severity incidents, identify whether results met thresholds, and place those results beside incident totals, severity, type, and six-month trends. section 12.5.1

Figure 12.2 Executive security operations dashboard showing high-level metrics and other high-level information

Inspect the dashboard artifact to see how MTTD is positioned among executive-level security operations metrics. section 12.5.1

How Cyber Threat Hunting covers it

How deep it goes

Defines elapsed detection time and applies it to thresholds, severity categories, dashboards, and incident narratives.

Examples

Uses monthly executive dashboards, incident timelines, severity thresholds, six-month trends, and delayed-detection investigations.

What you can do after

Evaluate detection performance and communicate delayed discovery through executive security metrics and incident reports.

How it connects

Connects security operations metrics with incident severity, threat hunting, executive dashboards, and mean time to contain.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityTime to detect is the elapsed time between a security incident or breach and its identification.
• 

  liveBookmanning.com
  Effective Platform EngineeringMean time to detect is the average elapsed time from the occurrence or discovery of a failure until the responsible team is notified and can engage.

Compare how 3 books explain mean time to detect →

Related concepts

• mean time to resolutionused by · Mean time to resolution is the average elapsed time from identifying or reporting an issue, failure, or incident until it is resolved or affected service is restored.
• metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
• data breachmeasures · A data breach is a security incident in which protected or sensitive data is accessed, disclosed, altered, acquired, or otherwise compromised without authorization.
• direct metrickind of · A direct metric is a measurement obtained by directly observing and recording the attribute, event, or phenomenon it represents.
• thresholdconfigured by · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.