In cybersecurity, dwell time is the time an attacker spends inside a network from the initial intrusion until the organization detects them. The longer it lasts, the more opportunity the attacker has to move laterally, steal data or stage ransomware. It is reduced through continuous monitoring and threat hunting, the proactive search for threats that evaded automated alerts.
Go deeper on the TecnetBlog: MTTD, MTTA and MTTR: What They Are and How to Measure Them
attacker dwell time, threat dwell time, mean dwell time, time to detect, breach dwell time
Related terms
Microsoft Sentinel
Microsoft Sentinel is Microsoft's cloud platform for SIEM (security information and event management) and SOAR (security orchestration, automation and response). It collects logs from Microsoft 365, Azure, firewalls and other sources, detects threats with analytics rules and behavior analysis, and automates responses. It was formerly called Azure Sentinel, and its queries use KQL (Kusto Query Language).
Incident containment and eradication
Containment and eradication are two phases of incident response. Containment limits the damage and keeps the attack from spreading, for example by isolating a device from the network or disabling a compromised account. Eradication removes the root cause: it deletes the malware, fixes the exploited vulnerability and removes the attacker's access before the team moves on to recovery.
Alert fatigue
Alert fatigue is the exhaustion security analysts experience when they receive more alerts than they can review, many of them false positives. The volume erodes attention and raises the odds of missing a real incident in the noise. It is reduced by tuning detection rules, correlating events, removing duplicate alerts and automating part of the triage process.
Alert triage
Alert triage is the process of reviewing, classifying and prioritizing security alerts to decide which ones are real incidents and in what order they are handled. The analyst validates the alert, enriches it with device, user and threat intelligence context, and either closes it as a false positive or escalates it. It is the first task of Tier 1 in a security operations center (SOC).
SOC tiers (Tier 1, 2 and 3)
SOC tiers are the way a security operations center (SOC) divides the work of its analysts. Tier 1 reviews each alert and decides whether it is real; Tier 2 investigates confirmed cases and contains them; Tier 3 hunts for threats the rules missed and improves detection. Each tier escalates to the next one whatever it cannot resolve on its own.
Breach and attack simulation (BAS)
Breach and attack simulation (BAS) is a technology that automatically and continuously runs real attack techniques, without harming systems, to check whether security controls block or detect them. Unlike a point-in-time penetration test, it repeats tests frequently and shows which controls need tuning, such as an endpoint agent that misses credential theft or a firewall rule that allows data exfiltration.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.