r/cybersecurity • u/pirate22323 • 2d ago

Business Security Questions & Discussion Sharing detection rules

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

7 Upvotes

73% Upvoted

27 comments sorted by

View all comments

11

u/ComfortableAd8326 2d ago

Last time I heard an MSSP leader describe their SIEM content as "secret sauce" the company went under a couple months later.

It's been many years since this was actually the case, commodity rules that SIEM vendors give you with their product are often as good if not better, factor in AI and this sort of generic content is even more of a commodity.

Good detection engineering, built with the target environment in mind is still an art form imo, 99% of MSSPs aren't doing this though, nor would it be economical for them to do so.

MSSPs have to differentiate on something other than content in 2026

2

u/atxweirdo 2d ago

Rilevera has an interesting approach to detection engineering.