Trying to calculate MTTD (Mean Time To Detect)

Elastic Security
1

Hello all,

I have been trying to calculate the MTTD, which consists of the difference between the case creation date and the first update of the case. However, when updating the case, the updated_at field gets updated as well.

image
image1591Ă—290 16.2 KB

However, any update in the case is available in the GUI.

image
image1308Ă—514 46.4 KB

2

Hello @YousefNein

As per the requirement , i think you can use below formula to calculate the correct time as per your requirement of MTTD :

Sample Data Considered of 1 Case :

image
image1188Ă—771 42 KB

Corresponding Data in Dataview :

image
image1909Ă—886 156 KB

User below formula :

min(cases-comments.created_at) - min(cases.created_at)

Output :

image
image1228Ă—387 22.7 KB

Thanks!!

3

Thanks, @Tortoise that will do. However, it will rely on the analyst not forgetting to write a comment. Do you know how to write a request to Elastic to add a “first_updated_at” field?

1 Like
4

Hello @YousefNein

What I calculated works only for a single case. The same approach does not work when we look at multiple cases together.

In Cases there are multiple child records (comments, status changes, user actions) created for each case, and they are linked indirectly using reference-style fields. Because of this structure it becomes hard to reliably identify when the first status change or triage action happened for each case across the dataset.

So we need a different approach for multi-case metrics like MTTD. I found a similar enhancement request for Alerting , maybe a similar enhancement would be needed for Cases to support these kinds of metrics ?

Thanks!!

1 Like