Status and Owner are the operational fields most directly associated with determining whether a finding has entered active analyst handling. Mean Time to Acknowledge (MTTA) measures the elapsed time between creation of a security finding and the point at which the SOC acknowledges and assumes responsibility for it.
Within an incident-management workflow, assigning an owner indicates analyst responsibility, while a status transition records progression through the handling lifecycle. These changes can therefore be used as workflow evidence when constructing SOC service-level measurements and determining whether findings are being acknowledged within the organization ' s expected response interval.
Urgency and severity describe prioritization characteristics rather than whether an analyst has actually taken ownership. Likewise, user normally describes an entity involved in the underlying security activity and does not represent the analyst responsible for the finding.
From a program-management perspective, MTTA should be distinguished from detection time, investigation duration, containment time, and Mean Time to Resolve/Respond. Each measures a different operational stage. Reliable status and ownership data therefore become important for SOC performance reporting and SLA/SLO auditing.
Question 10 appears on page 3 of the supplied material.
Study Guide topics: SOC metrics, MTTA, finding/notable management, status, ownership, service-level objectives, security-program reporting.
