Question

A SOC manager reviews quarterly metrics and finds that analysts are spending most of their shift closing alerts that turn out to be benign. Legitimate threats are being missed because analysts experience fatigue from the sheer volume of non-actionable tickets. Which incident response metric most directly quantifies this problem, and what improvement action does it point toward?

Accepted Answer

False positive rate — tune detection rules and correlation logic to reduce benign alerts

Answer

Mean time to detect (MTTD) — deploy additional sensors to shorten detection windows

Answer

Mean time to respond (MTTR) — add more analysts to speed up containment

Answer

Dwell time — improve threat hunting to find adversaries already inside the network