Security incidents uncovered

As explained in Cyber Threat Hunting

The count of security incidents discovered by threat hunting and referred for incident response.

Security incidents uncovered measures the number of incidents discovered through threat hunting and handed to the incident response team. Treat it as a time-bound performance metric, such as incidents uncovered during the past month, quarter, or year. Its value increases when paired with an identified audience, a clear representation, and a trend over time. section 12.3 section 2.7.1

Use the metric consistently by defining:

• The counting rule: include incidents uncovered by the threat-hunting process and referred to incident response. section 2.7.1
• The reporting period: specify a month, quarter, year, or another interval so results can be compared over time. section 12.3
• The presentation: report a number, identify the audience, and distinguish overall practice results from an individual play, process, or technology. section 12.3

Operations dashboard

A monthly dashboard reports eight threat-hunting expeditions and three incidents uncovered. A six-month view further breaks incidents down by severity, helping operations managers compare both volume and risk over time. section 12.5.3

Figure 12.7 Threat-hunting dashboard for the security operations manager

Use the threat-hunting dashboard to view incident discoveries alongside expeditions, vulnerabilities, configuration problems, monitoring rules, and severity trends. section 12.5.3

How Cyber Threat Hunting covers it

How deep it goes

Defines the count and reporting requirements, but stops short of prescribing detection or incident-response procedures.

Examples

Uses monthly expedition results and six-month severity breakdowns in an operations dashboard.

What it assumes

Assumes a threat-hunting process that can identify incidents and hand them to incident response.

What you can do after

Evaluate threat-hunting performance and compare incident discoveries across reporting periods.

How it connects

Connects threat hunting with incident response, security monitoring, and threat intelligence.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• threat huntingmeasures · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
• severitymeasures · Severity is an assessment or classification of how serious or impactful an issue, event, condition, or finding is, often expressed as an ordered level.
• vulnerabilities uncoveredmeasured by · The total count of vulnerabilities discovered through the threat-hunting process.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.