Glossary: Security Operations and Incident Response

Metrics

Also written: time to detect, time to contain, time to recover

Measurements in the incident report, such as time to detect, contain and recover, used to compare responses over time. At Kettle & Crane they were two minutes, eight minutes and two days.