A SOC manager is reviewing quarterly incident response metrics. She notices that while MTTD and MTTR are within targets, a significant number of incidents that were declared 'closed' by the tier-1 team reopened within 30 days because the threat was not fully removed. Which incident response metric should she track to specifically measure and improve this problem?