Working with many customers and lots of data on a network security monitoring platform inevitably leads to the question, “how can I start to track my network hunting activities?” or‚ how can I tie back my hunting outcomes to real impacts for the organization?‚ DFIR personnel invest lots of time in hunting today and threat hunting programs are encouraged as part of a mature and successful CIRT. However, management is looking for the‚ so what‚ or metrics to demonstrate the value of threat hunting in real terms. After all, threat hunting involves dedicating man-hours from highly skilled professionals – a big investment for enterprises. Therefore, it is natural to want to collect data to drive decisions. How do you know if a hunt is worthwhile? Are you wasting your time? What could I do to become a more efficient hunter? There is plenty of information on suggested metrics to collect to start answering these questions but there is a lack of direction how this can be done in an operational workflow. In this presentation, we will demonstrate how to operationally track and report on hunt outcomes that have helped our customers demonstrate value from threat hunting operations.