You need to calculate MTTR for cases. What should you do?

• A. Multi-event detection rule to calculate response metrics in outcomes and create a dashboard.
• B. Dashboard table displaying average case handling times by analyst, case priority, and environment.
• C. Reusable playbook block writing timestamps to case wall after each change and a job to calculate metrics.
• D. Use playbooks' case stages to capture metrics and create a dashboard.

Answer: (D)

Mean time to resolve (MTTR) requires precise, automated timestamps for the entire case lifecycle so you can measure how long it takes to move from creation to closure. Using the playbooks’ case stages to capture metrics provides a structured, consistent way to record when a case enters and exits each stage, including the overall start and end. With these timestamps in place, MTTR can be calculated automatically and you can display it on a dashboard, including breakdowns by stage, analyst, priority, or environment if needed.

The other approaches don’t establish a built-in, reliable data trail. A detects and aggregates response metrics, but it focuses on detection logic rather than the full lifecycle timing. B shows a dashboard of averages but doesn’t specify how the timing data is captured. C stores timestamps after changes in a case wall and then calculates metrics with a separate job, which can be error-prone and less maintainable than leveraging structured case stages built into the playbooks.