What is MTTR (Mean Time to Respond)?

MTTR begins at detection (or alert assignment) and ends when the analyst completes initial response: the threat is contained, escalated, or closed as a false positive. It encompasses investigation, evidence gathering, decision-making, and response execution.

Response actions include: isolating compromised endpoints via EDR, blocking malicious IPs at the firewall, disabling compromised accounts, and escalating to incident response teams. SOAR playbooks can dramatically reduce MTTR for well-understood alert types by automating enrichment and response steps.

Target MTTR varies by severity: critical incidents may require sub-15-minute response, while low-severity alerts might tolerate hours. Tracking MTTR by alert type identifies where automation or additional training would have the highest impact.