Calculator Inputs
Example Data Table
| Incident | Open Time | First Response | Severity | Response Minutes |
|---|---|---|---|---|
| INC-201 | 2026-03-03 08:05 | 2026-03-03 08:18 | Medium | 13 |
| INC-202 | 2026-03-03 09:40 | 2026-03-03 10:12 | High | 32 |
| INC-203 | 2026-03-03 10:15 | 2026-03-03 11:02 | Critical | 47 |
| INC-204 | 2026-03-03 12:20 | 2026-03-03 12:33 | Low | 13 |
Formula Used
Base MTTR = Total response minutes ÷ Total incidents.
Weighted MTTR = Sum of each incident response time × severity weight, divided by total incidents.
SLA Compliance = ((Total incidents − Breached incidents) ÷ Total incidents) × 100.
Incidents per Analyst = Total incidents ÷ Analysts on duty.
This calculator measures the average time between incident creation and the first analyst response, then adds workload and severity context.
How to Use This Calculator
- Select Aggregate Summary when you already know counts, total response minutes, breach counts, and critical incident volume.
- Select Incident Log when you want the calculator to derive response minutes from timestamps.
- Enter the number of analysts, your response SLA target, and a critical severity weight.
- Press Calculate to display results beneath the header and above the form.
- Use the CSV and PDF buttons to export the summary for reports or audits.
Frequently Asked Questions
1. What does mean time to respond measure?
It measures the average delay between incident creation and the first human response. Teams use it to judge triage speed, staffing balance, and operational responsiveness.
2. Why is first response different from resolution?
First response tracks acknowledgement speed. Resolution measures total time until the incident is contained or closed. Both are useful, but they answer different operational questions.
3. When should I use aggregate mode?
Use aggregate mode when you already have summarized weekly or monthly metrics from dashboards, SIEM reports, or ticketing systems and only need fast calculations.
4. When should I use incident log mode?
Use incident log mode when you have raw timestamps for each alert or case. It is helpful for audits, spot checks, and detailed team reviews.
5. What is weighted mean response time?
Weighted mean response time gives more influence to severe incidents. This helps managers avoid hiding critical delays inside a good overall average.
6. What should the critical weight factor be?
Many teams start between 1.5 and 2.0. Higher values emphasize urgent cases more strongly. Choose a factor that matches your internal severity policy.
7. How can I improve this metric?
Improve intake routing, automate alert enrichment, tune escalation rules, and balance staffing by shift. Faster notification paths usually reduce response times first.
8. Can this calculator support audits or reporting?
Yes. The summary table, parsed incident log, and export options make it easier to document response performance for leadership reviews, compliance evidence, and retrospectives.