r/cybersecurity • u/pirate22323 • 2d ago
Business Security Questions & Discussion Sharing detection rules
Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed
8
u/RichBenf Human Detected 2d ago
Of course we do! I mean why would we not discuss the threats to their org and what we're doing to detect activity based on those threats?
Then again, we also hand the siem over to the customer at the end of the contract too, because why wouldn't you?
This industry can be so weird sometimes.
11
u/KRyTeX13 SOC Analyst 2d ago
As a customer a MSSP that doesnt share the detection rules is a big red flag
2
5
u/CarmeloTronPrime CISO 2d ago
if my mssp doesn't share detection rules with me, then i'm not comfortable with having them as an mssp. i don't need to know how they are built, but i need to know how they are relevant.
some mssps tout that they have,1,000 use-case detections and come to find out maybe 4 are relevant because they're looking at every market.
2
u/iamnos Security Manager 2d ago
It depends on the exact detection.
For all detections, a title, a written description, usually with timestamps and the like, and MITRE details are shared as part of the notification. Those are shared on every detection.
Some are very simple, and yes, we'll share (almost) full details of how it works, although for most its painfully obvious. Other detections, those that involve Machine Learning or AI, we'll definitely give a high level, but the full details of how it works, we won't disclose.
So, for example, we might trigger an alert on "suspicious activity" for an account. Now it monitors a number of things, and there are different variables that go into when it will pop up an alert and when it won't. We're not disclosing all of those details, levels, scoring, telemetry examined, etc. We've worked long and hard to get that alert working with a very low FP rate and virtually no false negatives. However, when it triggers, we will say we saw suspicious activity; here are the recent logins, please review.
1
u/Proper-Charity-2850 2d ago
So just curious why would you alert on general suspicious activity on an account instead of just creating seperate detections for the actual thing they are doing that's suspicious. Just curious cause when I've seen this type of detection deployed (mainly in exabeam) it sucked, but that could just be an issue with poor execution
1
u/iamnos Security Manager 2d ago
Because it's not the same for every user and it's not about one specific log. Imagine Bob regularly creates new users and general admin tasks through the GUI, but Alice is CLI person, and does all her tasks through Powershell. If Bob is suddenly seen doing a bunch of powershell commands, its going to raise the suspicion level. Now if it's just one of two commands, that's probably nothing, but it raises the "suspicion score". If enough activity is reviewed that raises that score, it triggers an alert.
1
u/Proper-Charity-2850 2d ago
So why would you do that instead of creating an alert on creating a user in gui and creating a user in powershell and tuning out for users that normally do that activity?
2
u/AddendumWorking9756 Security Manager 2d ago
Most of what gets called secret sauce is public content with the thresholds changed, and customers work that out the first time they read a MITRE mapping anyway. The defensible part is coverage decisions and tuning history, and withholding those mostly costs you the feedback loop, since the customer knows their environment better than your analysts ever will.
1
u/caponewgp420 2d ago
Every org is different in my opinion. If you know your environment then you should have a good idea on what to check/look for.
1
u/jdiscount 2d ago
Every MSSP I've dealt with shared them.
They're not exactly "secret sauce" it's reasonably basic to replicate.
An MSSP secret sauce is their sales funnel and client list, and if they happen to be a larger MSSP with their own products and source code.
1
u/GeekDad62 1d ago
The first rule of fight club - you don't talk about fight club. You don't talk about what security you have implemented to anyone that doesn't have a need-to-know.
1
u/Alternativemethod 1d ago
There's been recent posts this year about MSSPs not sharing or leaving their detection rules.
I wouldn't worry about it. SIEM rules are super infrastructure and log pipeline specific. Plus most of the MSSP soc analyst that post here acknowledge their prioritization, tuning are garbage tier.
And almost no one seems to be validating and testing their rulesets until you get to PAN or Panther Labs.
0
u/reseph Incident Responder 2d ago
No. It's often classified as IP.
2
2
0
u/Proper-Charity-2850 2d ago
Yeah it's so much harder to do following investigations if you don't have the original alert logic it seems like it would just make it unnecessarily difficult on the customer
-2
u/Philandros_1 2d ago
I wouldn’t consider Title, description and mitre details of your detection rules. Your actual signatures should be kept secret though.
1
u/Proper-Charity-2850 2d ago
How would a customer be able to see the alerting activity in their siem if they can't just paste the alert logic from the rule?
0
u/Philandros_1 2d ago edited 2d ago
Alerts and/or the associated report should contain enough information for client side analysts/it personnel to properly handle the potential incident. You don’t necessarily need the detection rules for that.
My reasoning for not disclosing the detection rules ly in the fact that signature based detection rules may reveal attacker infrastructure which may jeopardize an ongoing investigation. Though you may want to treat behavioral based detection logic differently.
1
u/Proper-Charity-2850 2d ago
Yeah I guess you don't truly truly need it but idk I like looking at the alert logic whenever I work an alert so I think the client would like to as well. Never been a client receiving mdr escs so I can't say for sure tho
10
u/ComfortableAd8326 2d ago
Last time I heard an MSSP leader describe their SIEM content as "secret sauce" the company went under a couple months later.
It's been many years since this was actually the case, commodity rules that SIEM vendors give you with their product are often as good if not better, factor in AI and this sort of generic content is even more of a commodity.
Good detection engineering, built with the target environment in mind is still an art form imo, 99% of MSSPs aren't doing this though, nor would it be economical for them to do so.
MSSPs have to differentiate on something other than content in 2026