This chapter covers
- Measuring and reporting success
- Defining success in the context of threat hunting
- Identifying and discussing the areas for measuring success
- Identifying and describing important threat-hunting metrics
- Reporting success to stakeholders
- Communicating discoveries
Until now, our primary focus has been on conducting threat-hunting operations: uncovering threats, conducting incident investigations, and collaborating with other teams to request information or share findings. In this chapter, we consider governance and answer a few essential questions:
- Did our work add value to the business?
- How can we evaluate that value?
- Should we have done some things better?
- How can we improve the threat-hunting practice?
In this chapter, we define success in the context of threat hunting. We outline methods for establishing and extracting essential measurements to calculate key-value metrics. In addition, we provide valuable insights into good practices for reporting and communicating threat-hunting performance to different roles within the organization.