How to find Mean Time to Respond in Rapid7 for all the Investigations being worked upon.
It would depend on what you mean by “respond”. If you’re basing the definition on the first time you open the investigation after it has been created then there is no way to pull that info. However, if you’re referring to the time in which you closed the investigation then you can get that from either the log search or the the API using the last_accessed time (assuming you have not been back into the investigation after it was closed).