hard20 pts · first answer countsincident-responseir-metrics
Computing dwell and containment time
Initial access happened on 1 March at 09:00. The SOC detected it on 4 March at 15:00 and contained it on 4 March at 21:00. What are the dwell time (access to detection) and the time to contain (detection to containment)?
Discussion 0
Join free to post in the discussion.
Related questions
- Backups that survive ransomwareCybersecurity Analyst
- Why chain of custody mattersCybersecurity Analyst
- Security event or security incidentCybersecurity Analyst
- What makes malware a trojanCybersecurity Analyst
- Double extortion ransomwareCybersecurity Analyst
- What a rootkit is forCybersecurity Analyst
- What an infostealer takesCybersecurity Analyst
- What fileless malware meansCybersecurity Analyst