Why has Expel's Managed Detection and Response (MDR) service seen a 15% drop in alert response times over the past month?

Introduction

Expel's Managed Detection and Response (MDR) service has experienced a 15% drop in alert response times over the past month, indicating a significant decline in performance. This issue requires immediate attention as it directly impacts the core value proposition of the MDR service - rapid threat detection and response. I'll approach this problem systematically, focusing on identifying the root cause, validating hypotheses, and developing both short-term fixes and long-term solutions.

Step 1

Clarifying Questions (3 minutes)

• Looking at the timing, I'm thinking there might have been a recent change in the system. Has there been any significant update or modification to the MDR platform in the last 1-2 months?

Why it matters: Recent changes often correlate with performance shifts. Expected answer: Yes, there was a major update. Impact on approach: If yes, we'd focus on the update's impact; if no, we'd look at other factors.

• Considering the nature of MDR services, I'm curious about the alert volume. Has there been a notable increase in the number of alerts being processed by the system recently?

Why it matters: Alert volume directly affects response times. Expected answer: Alert volume has increased by 20%. Impact on approach: A significant increase would lead us to investigate scaling issues.

• Given the importance of human analysts in MDR, I'm wondering about staffing. Have there been any changes in the analyst team size or composition in the past month?

Why it matters: Staff changes can impact response times. Expected answer: No significant changes in staffing. Impact on approach: If there were changes, we'd focus on training and onboarding; if not, we'd look elsewhere.

• Thinking about the alert response process, I'm curious about the alert prioritization system. Has there been any modification to how alerts are categorized or prioritized?

Why it matters: Changes in prioritization can affect overall response times. Expected answer: No changes to the prioritization system. Impact on approach: If changed, we'd examine the new system's impact; if not, we'd investigate other process elements.