What it means
Mean time to detect, often shortened to MTTD, averages the elapsed time between a defined starting event and a defined detection event. The definition matters more than the label. A clock starting at attacker entry measures something different from one starting when a relevant log reaches the monitoring system. The average also describes only the incidents included; undetected activity and cases with an unknown start time can distort the interpretation. Report the population, uncertainty, and clock definitions alongside the number, and examine the distribution rather than relying on one average.
AN ILLUSTRATIVE SCENARIO
A retailer investigates a fast dashboard
A retailer's dashboard says detection takes five minutes because it measures from log ingestion to alert creation. Investigators discover that the source delivers records in hourly batches. The monitoring rule may be quick once data arrives, but the complete detection delay is much longer. The team separates source delay, processing delay, and analyst recognition time. It reports a median and a slow-tail measure alongside the mean so a few very late cases are not hidden by many quick alerts.
Put it to work
- Choose the behavior or incident class being measured and define start and end events. Record timestamps, clock assumptions, unknown values, and the population of cases included in the calculation.
- Calculate delays consistently and separate collection latency from analysis or recognition latency where useful. Show sample size, missing cases, median, and a meaningful tail measure alongside the mean.
- Use changes in the measure to investigate causes such as missing logs, batching, or weak rules. Pair speed with detection coverage and accuracy so teams are not rewarded merely for producing quick, unhelpful alerts.
How to check your work
Trace several cases from source event through collection and detection, recompute the reported intervals, and explain excluded or uncertain cases. Use a controlled test with a known start time to check the complete path, including delayed log delivery.
Connect the ideas
- Coverage
An explicit statement of which sources, time windows, and rows were actually collected, including truncation.
- Recall
Detected true events divided by all true events in a defined evaluation set: TP / (TP + FN). Unknown missed events limit production estimates.
- Log
A record emitted by a system that something happened, which may later be used as evidence.