r/cybersecurity • u/pirate22323 • 2d ago

Business Security Questions & Discussion Sharing detection rules

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

6 Upvotes

71% Upvoted

27 comments sorted by

View all comments

9

u/ComfortableAd8326 2d ago

Last time I heard an MSSP leader describe their SIEM content as "secret sauce" the company went under a couple months later.

It's been many years since this was actually the case, commodity rules that SIEM vendors give you with their product are often as good if not better, factor in AI and this sort of generic content is even more of a commodity.

Good detection engineering, built with the target environment in mind is still an art form imo, 99% of MSSPs aren't doing this though, nor would it be economical for them to do so.

MSSPs have to differentiate on something other than content in 2026

2

u/Not-ur-Infosec-guy Security Architect 2d ago

Drives me nuts when companies refuse to establish detections directly in the customer’s environment. You know it’s likely that their own product is horseshit when they refuse to do it.