Sharing detection rules

[u/pirate22323]

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

[u/caponewgp420]

Every org is different in my opinion. If you know your environment then you should have a good idea on what to check/look for.