Break mean time to detect into dwell, telemetry lag, rule interval, queue delay and analyst confirmation, and find the bottleneck.
Halving the rule interval is the right adjustment for a scheduled search: if a rule runs every fifteen minutes, activity arrives uniformly across the window, so the expected wait is 7.5 minutes. Summing the phases makes it obvious whether MTTD is dominated by missing telemetry or by a slow pipeline. MTTD sets the ceiling on how much damage an intrusion can do, and the two fixes — more telemetry versus a faster pipeline — cost entirely different amounts, so knowing which phase dominates is what makes the metric actionable.
MTTD
MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation.
Dwell share
Dwell share = pre-signal dwell ÷ MTTD, which separates a telemetry gap from a pipeline problem.
MTTD = pre-signal dwell + telemetry lag + (rule interval ÷ 2) + queue wait + analyst confirmation. Halving the rule interval is the right adjustment for a scheduled search: if a rule runs every fifteen minutes, activity arrives uniformly across the window, so the expected wait is 7.5 minutes. Summing the phases makes it obvious whether MTTD is dominated by missing telemetry or by a slow pipeline.
MTTD sets the ceiling on how much damage an intrusion can do, and the two fixes — more telemetry versus a faster pipeline — cost entirely different amounts, so knowing which phase dominates is what makes the metric actionable.
This calculator takes 6 inputs: Dwell before any signal is generated, Telemetry collection and shipping lag, Scheduled rule interval, Alert queue wait before triage, Analyst confirmation time, Benchmark dwell time to compare against. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because they have different owners. Pre-signal dwell shrinks by instrumenting more of the estate — identity, EDR, cloud control plane — while pipeline latency shrinks by shortening rule intervals, streaming instead of batching, and staffing the queue. Reporting one number hides which lever to pull.
From post-incident timelines: the gap between the earliest attacker action you can evidence and the first log entry that could have alerted. If forensics cannot reach the initial access, treat your figure as a lower bound and say so.