Time-to-resolution (TTR) is the time from when an incident is reported to the time it is resolved, and a critical incident management KPI. Automating common steps such as indication of compromise, reconnaissance, and defining last-known-good state can enable data-driven decisions to improve TTR. In this session, I will propose opportunities in the incident lifecycle that can be automated and ultimately reduce the security risk to your environment by resolving incidents quickly.
