How to determine the success of a hunting program
We mentioned some of the key points that define a successful threat hunting program in the previous chapter, Chapter 12, Understanding the Output. The definition will vary depending on the organization's mission, but it should cover at least the following:
- The hunting team has established a data model and a data quality assurance process.
- The hunting team drives all their hunts using threat intelligence relevant to the organization.
- The hunting team is detecting visibility gaps too.
- The hunting team is properly automating all generated detections.
- The hunting team is properly documenting the hunts, successful or not.
On top of these goals, we can also assess the success of the threat hunting program depending on the threat hunting team's maturity evolution. For this, as explained in Chapter 2, What Is Threat Hunting?, you can use David Bianco's Threat Hunting Maturity Model:
...
