Engineering Incident Metrics Operational

Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD): Time from incident start to detection.

Also known as: MTTD

Formula

MTTD = Average of (Detection time - Incident start time)

Computable definition

The canonical formula in the GASP formula grammar. The MCP server compiles it to SQL over the datasets listed below.

(avg(field.detected_at - field.started_at)) * 1440

Unit: minutes

Notes: Detection time minus incident start time.

Data requirements

Grain: Per event · Frequency: Per incident · Aggregation: event · Staged: no · Main source: Incident Management.

Field	Dataset	Type
`detected_at`	incident	timestamp
`started_at`	incident	timestamp

Example SQL (Postgres)

SELECT ((SELECT AVG((EXTRACT(EPOCH FROM (detected_at - started_at)) / 86400.0)) FROM incident WHERE started_at >= :period_start AND started_at < (:period_end + INTERVAL '1 day')) * 1440) AS mean_time_to_detect_mttd

From an agent: with the GASP MCP server, call lookup_metric({ "name": "Mean Time to Detect (MTTD)" }) or generate_query({ "metric": "Mean Time to Detect (MTTD)", "adapter": "<your adapter JSON>" }).

What It Tells You

Monitoring and alerting effectiveness.

← Back to Engineering metrics