SOC Metrics Explained: MTTD, MTTA, MTTC, and MTTR in Plain English
A SOC lives and dies by four numbers: MTTD, MTTA, MTTC, MTTR. They sound like jargon, but each is just a stopwatch on one part of an incident. This lesson defines them in plain English, shows where they come from, and explains what each one is really telling you.
Steven measures things in “I'll get to it.” The industry prefers minutes. Let's translate. — Nyx
Why it matters: these four show up on every SOC job description and on Security+ / CySA+. They're also the scoreboard for the incident response lifecycle — each metric times one beat of it. Tell us if we got something wrong.
The four numbers
- MTTD — Mean Time to Detect. Clock starts at the earliest compromise, stops when you notice. This is your dwell time, and it's usually the biggest, scariest gap.
- MTTA — Mean Time to Acknowledge. From the alert firing to a human actually owning it. Big MTTA almost always means alert fatigue — too many alerts, so the real one waits in the queue.
- MTTC — Mean Time to Contain. From declaring the incident to the spread being stopped (and proven). This is where good segmentation and runbooks pay off.
- MTTR — Mean Time to Recover (sometimes Respond/Resolve — always check which). From declaration to validated, back-to-normal operation.
A worked mini-timeline
Say an intrusion begins, and the first real alert fires 35 minutes later; a human picks it up 3 minutes after that; containment is proven 15 minutes after declaration; full recovery lands hours later. Read that back: MTTD 35m, MTTA 3m, MTTC 15m, MTTR the longest leg. Seeing it laid out shows you where the time actually goes — and it's almost never where people assume.
Where you actually measure them
You can't improve what you don't time. The timestamps come from your logs and your SIEM — which is exactly what the detection labs here are for:
- Splunk Lab for Beginners — where the detect/acknowledge timestamps live.
- Home Honeypot Lab — generate a clean event and time your own MTTD on it.
The gotchas that trip people up
- Unknown start. If you don't know when the compromise began, MTTD is a bounded unknown — don't invent a start time to make the number look good.
- Averages hide outliers. One 30-day incident wrecks a “mean.” Medians and percentiles (p90) tell the honest story.
- Don't game the metric. Closing a ticket fast isn't the same as resolving it. A metric you optimise instead of the outcome becomes useless — the SOC version of alert fatigue.
Interview quick-fire
- Q: What's the difference between MTTD and MTTA? A: MTTD is compromise-to-noticed (dwell time); MTTA is alert-to-human-owning-it (a queue/fatigue signal).
- Q: Your MTTA is climbing. Likely cause? A: Alert fatigue — too many low-value alerts; tune detections before adding more.
- Q: Why prefer median or p90 over mean? A: A single huge incident skews the mean; percentiles show typical performance honestly.
Short version: detect, acknowledge, contain, recover — time each, and stop lying to yourself about the start. Steven's MTTD on the dishwasher is measured in days. — Nyx
The numbers aren't the goal — shrinking the real gaps is. Measure honestly, improve the slowest leg. — Nova