How deeply does Cyber Threat Hunting cover threat-hunting metric?

Provides a metric-design checklist and a broad KPI inventory, while deferring detailed metric operation elsewhere.

Threat-hunting metric

A quantitative measure used to evaluate the effectiveness and performance of a threat-hunting practice.

A threat-hunting metric quantifies the status and performance of a hunting practice. It makes value visible across people, processes, technologies, and time, while identifying improvements for hunting, security monitoring, threat intelligence, and related security work. section 12.3 section 2.7.1

Define each metric with its data sources and collection method, a numeric or percentage representation, a reporting period, an audience, its improvement value, and its scope: overall practice, individual play, process, or technology. section 12.3

Useful high-value metrics, or KPIs, include:

Hunting expeditions conducted and completed against plan. section 12.3
Incidents, vulnerabilities, and misconfigurations uncovered. section 2.7.1 section 12.3
Security monitoring use cases created and IOCs shared with other teams. section 2.7.1 section 12.3
Technology coverage, such as systems with osquery installed; documented plays; MITRE ATT&CK technique coverage; reports; and internal awareness sessions. section 12.3

Showing value when a hypothesis is not proved

A hunt may find no threat execution yet still uncover an incident, vulnerability, or misconfiguration. Record those byproducts alongside planned expedition activity to demonstrate value and guide improvement. Tailor reports to operational leaders, the CISO, and the CIO. section 12.1 section 12.2

Metrics are not merely scorekeeping. At a quantitatively managed maturity level, they are established, reported, and acted on to sustain and improve the practice. section 2.8.1

How Cyber Threat Hunting covers it

liveBook manning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

key performance indicatorincludes · A key performance indicator is a selected measurable value used to evaluate performance or progress toward an important objective.
data sourceused by · A data source is an origin, system, repository, or process from which data is obtained for use or processing.
threat huntingmeasures · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
dashboardused by · A dashboard is a visual interface that consolidates selected data, metrics, or status information for monitoring, analysis, or decision-making.
metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.