Why has Arctic Wolf's Managed Detection and Response service seen a 15% drop in alert resolution times over the past month?

Introduction

Arctic Wolf's Managed Detection and Response (MDR) service has experienced a 15% drop in alert resolution times over the past month, indicating a significant decline in performance. This analysis will systematically investigate the root cause of this issue, considering both internal and external factors that could be impacting the service's efficiency.

Step 1

Clarifying Questions (3 minutes)

• Looking at the timing, I'm thinking there might be a recent change in the alert processing system. Has there been any significant update to the MDR platform or underlying infrastructure in the past 1-2 months?

Why it matters: Recent changes could directly impact alert resolution times. Expected answer: Yes, there was a major update to the alert prioritization algorithm. Impact on approach: If confirmed, we'd focus on the new algorithm's performance and potential bugs.

• Considering the scale of the drop, I'm wondering about staffing changes. Have there been any significant changes in the SOC team composition or size recently?

Why it matters: Staff changes could affect the team's capacity to handle alerts efficiently. Expected answer: No major changes in staffing. Impact on approach: If staffing is stable, we'd look more closely at technical or process-related issues.

• Given the nature of MDR services, I'm curious about the alert volume. Has there been a notable increase in the number of alerts being generated in the past month?

Why it matters: A surge in alerts could overwhelm the system or staff, leading to longer resolution times. Expected answer: Alert volume has remained relatively consistent. Impact on approach: If volume is stable, we'd focus on internal processes or system performance issues.

• Thinking about the metric itself, I'm wondering about its consistency. Has the definition or measurement method for "alert resolution time" remained the same over the past few months?

Why it matters: Changes in metric definition could lead to apparent performance drops without actual service degradation. Expected answer: The metric definition has not changed. Impact on approach: If consistent, we'd focus on actual performance issues rather than measurement discrepancies.