Time to resolve
Time to resolve runs from detection to the incident being closed, after containment, eradication and recovery. It is longer than time to contain and often includes waiting on other teams. A shorter time to resolve does not show that the attacker was stopped sooner.
Definition
Resolution includes work that automation rarely shortens, such as rebuilding hosts, restoring data and writing the report. A vendor that quotes resolution time may be measuring the ticket, not the attack.
Use time to resolve for operations planning. Use time to contain to judge a response platform, because it measures the step that limits harm.
Time to resolve in Google Security Operations's documentation
Google's Security Operations product page says its SOAR includes tracking of analyst productivity and MTTR, and quotes Apex Fintech Solutions cutting time to detect and investigate from 2 hours to about 15 to 30 minutes. vendor claim Source: cloud.google.com/security/products/security-o... · Read
The example names a vendor and its own page. A vendor's use of Time to resolve may differ from the definition above; the rubric uses the definition on this page.