Comment by quectophoton

The best way to consistently having good "time to response" metrics, is to be the one deciding when an incident "actually" started happening, if at all :)