Mean time to detect

As explained in Effective Platform Engineering

Mean time to detect is the average elapsed time from the occurrence or discovery of a failure until the responsible team is notified and can engage.

Mean time to detect measures the average elapsed time from a failure’s occurrence or discovery until the team able to fix it is notified and can engage. It evaluates the platform’s incident-detection path, not merely whether an alert exists. section 3.4.3

Measure MTTD by combining automated detection with effective escalation:

• Configure automated systems to watch relevant metrics, logs, or traces and trigger alerts. section 3.4.3
• Measure the interval from problem discovery to notification and engagement by the team with the most repair context. section 3.4.3
• Expand beyond known health indicators: monitoring specific problems is necessary but covers only part of failure management. section 3.4.3

MTTD is an early incident-response metric. Mean time to recover combines detection time with the time from detection to resolution, while incident detection time and mean time to acknowledge provide leading signals for improving monitoring and alerting. section 3.4.3 section 10.1.2

Figure 10.2 Key leading metrics used by Epetech to understand and use the DORA lagging metrics

Use the leading-metrics figure to relate incident detection time and acknowledgement to broader platform and DORA measurement. section 10.1.2

How Effective Platform Engineering covers it

How deep it goes

Defines the timing boundary and required monitoring, but stops short of specifying alert rules or escalation implementation.

Examples

Uses metrics, logs, traces, automated alerts, health indicators, and incident detection time as measurement artifacts.

What you can do after

Diagnose monitoring and alerting delays by measuring discovery-to-engagement time and comparing it with recovery metrics.

How it connects

Connects monitoring, alerting, mean time to recover, mean time to acknowledge, change failure rate, and DORA metrics.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityTime to detect is the elapsed time between a security incident or breach and its identification.
• 

  liveBookmanning.com
  Cyber Threat HuntingTime to detect is the elapsed time between the occurrence or initiation of a security event and its detection.

Compare how 3 books explain mean time to detect →

Related concepts

• mean time to resolutionused by · Mean time to resolution is the average elapsed time from identifying or reporting an issue, failure, or incident until it is resolved or affected service is restored.
• metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.
• data breachmeasures · A data breach is a security incident in which protected or sensitive data is accessed, disclosed, altered, acquired, or otherwise compromised without authorization.
• direct metrickind of · A direct metric is a measurement obtained by directly observing and recording the attribute, event, or phenomenon it represents.
• thresholdconfigured by · A threshold is a boundary value against which a quantity is compared to determine whether a condition is met or an action or decision is triggered.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.