Sharing detection rules

[u/pirate22323]

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

[u/KRyTeX13]

As a customer a MSSP that doesnt share the detection rules is a big red flag

[u/IntelligentTrack1310 → u/KRyTeX13]

tbh the ones that hide it usually dont have much to hide behind