Which three metrics describe SOC efficiency: MTTD, MTTR, MTTRem?

• A. Mean Time to Detect/Respond/Remediate
• B. Mean Time to Detect/Remediate/Return
• C. Mean Time to Ingest/Transmit/Receive
• D. Mean Time to Review/Remediate/Repair

Answer: (A)

Understanding SOC efficiency means looking at how quickly the team moves an incident from detection through response to full remediation. The best three metrics that describe this are Mean Time to Detect, Mean Time to Respond, and Mean Time to Remediate. MTTD measures how fast a threat is discovered after it enters the environment. MTTR captures how quickly the team acts to contain and handle the incident once it’s detected. MTTRem gauges how long it takes to implement fixes, remove artifacts, patch or rebuild affected systems, and restore normal operations. Taken together, these three metrics cover the full incident lifecycle—detection, response, and remediation—providing a clear view of SOC efficiency and highlighting where improvements reduce dwell time. The other options mix in nonstandard terms or focus on stages that aren’t part of the typical incident lifecycle (for example, data flow terms or a stage like “return” that isn’t a standard security metric).