MIM Post Incident Report Response Timeline Mechanics

[Lucas51]

On a major incident, use the View Workbench ui action, then go to the Post Incident Report, and then click on View Complete Report. There you will be able to see the Incident Response Timeline.

Does anyone know the driving mechanics or code behind the Duration values for the Timing Types? Specifically, our Time to Respond metric is always 00:00:00 and only the Time to Identify is addressed in the documentation. If anyone had knowledge on the other three metrics I would appreciate the info.

[Richard C · Accepted solution]

I happen to be digging into this right now!

Time to Identify is calculated by subtracting the time the incident was created from the time the incident was proposed, and if there is no propose time, from the time the incident was promoted.

Time to Respond is the time the incident was promoted minus the time the incident was proposed. If there is no propose time (the incident was promoted to MI without ever being proposed), this will show 00:00:00.

Time to Resolve is the time the incident was changed to a Resolved state, minus the time the incident was promoted.

Time to Close is the time the incident was Closed minus the time the incident was resolved.