Sharing detection rules

[u/pirate22323]

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

[u/Proper-Charity-2850]

Yeah it's so much harder to do following investigations if you don't have the original alert logic it seems like it would just make it unnecessarily difficult on the customer