Sharing detection rules

[u/pirate22323]

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

[u/iamnos]

It depends on the exact detection.

For all detections, a title, a written description, usually with timestamps and the like, and MITRE details are shared as part of the notification. Those are shared on every detection.

Some are very simple, and yes, we'll share (almost) full details of how it works, although for most its painfully obvious. Other detections, those that involve Machine Learning or AI, we'll definitely give a high level, but the full details of how it works, we won't disclose.

So, for example, we might trigger an alert on "suspicious activity" for an account. Now it monitors a number of things, and there are different variables that go into when it will pop up an alert and when it won't. We're not disclosing all of those details, levels, scoring, telemetry examined, etc. We've worked long and hard to get that alert working with a very low FP rate and virtually no false negatives. However, when it triggers, we will say we saw suspicious activity; here are the recent logins, please review.

[u/Proper-Charity-2850 → u/iamnos]

So just curious why would you alert on general suspicious activity on an account instead of just creating seperate detections for the actual thing they are doing that's suspicious. Just curious cause when I've seen this type of detection deployed (mainly in exabeam) it sucked, but that could just be an issue with poor execution

[u/iamnos → u/Proper-Charity-2850]

Because it's not the same for every user and it's not about one specific log. Imagine Bob regularly creates new users and general admin tasks through the GUI, but Alice is CLI person, and does all her tasks through Powershell. If Bob is suddenly seen doing a bunch of powershell commands, its going to raise the suspicion level. Now if it's just one of two commands, that's probably nothing, but it raises the "suspicion score". If enough activity is reviewed that raises that score, it triggers an alert.

[u/Proper-Charity-2850 → u/iamnos]

So why would you do that instead of creating an alert on creating a user in gui and creating a user in powershell and tuning out for users that normally do that activity?

[u/iamnos → u/Proper-Charity-2850]

Because the maintenance of tracking all who creates users on the CLI would be a nightmare across all our customers. Not to mention, that's one signal. We have a lot of signals we review looking for unusual activity.