CompTIA CySA+ (CS0-003)Security OperationsHard
A security manager reviews an incident timeline: initial compromise occurred at 09:50, the SIEM generated an alert at 10:02, an analyst began triage at 10:10, and containment was completed at 10:45. Based on this timeline, what is the Mean Time to Detect (MTTD) for this incident?
- A35 minutes
- B43 minutes
- C8 minutes
- D12 minutes
Show answer & explanationAnswer & explanation
Correct answer: D. 12 minutes
MTTD measures the time from when a compromise actually occurs to when it is detected (alert generated): 10:02 minus 09:50 = 12 minutes. The 8-minute figure reflects triage acknowledgment delay after the alert, 35 minutes reflects containment time after triage began, and 43 minutes reflects total time from alert to containment (a component of MTTR), not detection time.
Why the other options are wrong
- A. 35 minutes is triage-to-containment time, unrelated to detection.
- B. 43 minutes is alert-to-containment time, part of MTTR, not MTTD.
- C. 8 minutes is the gap between alert and analyst triage start, not detection time.
Mean Time to Detect (MTTD)
An incident response metric measuring the average time elapsed between when a compromise actually begins and when it is detected by monitoring/alerting systems.
- Calculated as detection time minus actual occurrence time
- Lower MTTD indicates more effective monitoring/detection capability
- Distinct from MTTR (time to respond/resolve after detection)
Memory trick: 'MTTD clocks the sneak-in to the alarm; MTTR clocks the alarm to the all-clear.'