MTTA and MTTR: Measuring How Fast Your Fleet Actually Responds

Every fleet operator lives with two different questions about their alert backlog, and it is worth being clear about which one you are answering. The first is what is on fire right now? — the live-triage question. The second is are we actually getting better at putting fires out? — the responsiveness question. WinSentinel Pro's alerts triage answers the first. The new alerts responsiveness verb answers the second.

Triage looks forward; MTTR looks back

Triage is a snapshot of your open backlog measured against per-severity response SLAs: which alerts have breached, which are close, and which are comfortable. It is the right tool for the on-call operator deciding what to touch next. But triage says nothing about the alerts you already closed — and that history is where the real signal about team health lives.

Two retrospective metrics capture it:

• MTTA (Mean Time To Acknowledge) — how long an alert sat before someone said “I've got this.” High MTTA usually means an alerting or routing problem: nobody is seeing the alert fast enough.
• MTTR (Mean Time To Resolve) — how long from the alert firing to it being closed. High MTTR means the fix is slow: unclear ownership, hard remediation, or a band you're quietly neglecting.

Reading the report

winsentinel-fleet alerts responsiveness folds your resolved alert history over a trailing window (30 days by default) into overall and per-severity percentiles:

Alert responsiveness (MTTA/MTTR, last 30d)
------------------------------------------
  Window:     84 alert(s) created  ·  71 acked  ·  63 resolved
  MTTA:       median 12m  ·  mean 41m  ·  p90 2h  ·  max 9h
  MTTR:       median 3h  ·  mean 14h  ·  p90 2d  ·  max 6d

  MTTR by severity (median vs target):
    [critical] n=6   ·  median 2h   (target 4h)   ✓ ok
    [high]     n=22  ·  median 6h   (target 12h)  ✓ ok
    [medium]   n=25  ·  median 41h  (target 48h)  ✓ ok
    [low]      n=10  ·  median 7d   (target 5d)   ✗ over

  Slowest band: low (median MTTR 7d - 2d over target)

A few things to notice about how this is built to be honest:

• We report median alongside mean. Mean is dragged around by a single stale outlier; median tells you what a typical alert experienced. When mean is far above median (as with MTTR above), you have a long tail worth investigating — look at max and p90.
• Each severity band's median MTTR is checked against a resolve target (critical 4h, high 12h, medium 48h, low 120h by default), so “is 6 hours good?” has a built-in answer that depends on severity.
• The slowest band is chosen by median-vs-target ratio, not raw time — so a critical that's slightly over its tight target can outrank a low that's way over a loose one. That's usually the band worth a retro.

What a healthy trend looks like

A single reading is a baseline; the value is in the trajectory. Run it weekly and you want to see:

1. MTTA flat and low. Acknowledgement is a routing/awareness problem, not an effort problem — it should be minutes, and it shouldn't drift. If MTTA is creeping up, your alert delivery (webhooks, on-call rotation) needs attention before anything else.
2. MTTR trending down or stable within target. A rising MTTR on a specific band is the earliest sign that band is being deprioritized — often low and medium, which is fine until a “low” turns out to be the foothold in an incident review.
3. Mean converging toward median. Shrinking the gap means you're killing the long tail of forgotten alerts, not just handling the easy ones fast.

Because the whole computation runs client-side from the fleet's existing alert stream, it's export-friendly too: add --csv for a per-severity table you can drop into a monthly ops review or a compliance evidence pack, and --window <days> to line the report up with your reporting cadence.

Triage keeps today from slipping. Responsiveness keeps this quarter from slipping. You want both: one tells your on-call what to do next, the other tells your lead whether the team is winning.

MTTA/MTTR reporting is part of WinSentinel Pro's fleet control plane, alongside triage, drift alerts, compliance rollups, and remote command dispatch. The single-machine WinSentinel agent — every audit module, the monitor, scheduled scans, and PDF reports — stays free and unlimited.