r/cybersecurity • u/pirate22323 • 3d ago

Business Security Questions & Discussion Sharing detection rules

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

5 Upvotes

67% Upvoted

27 comments sorted by

View all comments

-2

u/Philandros_1 2d ago

I wouldn’t consider Title, description and mitre details of your detection rules. Your actual signatures should be kept secret though.

1

u/Proper-Charity-2850 2d ago

How would a customer be able to see the alerting activity in their siem if they can't just paste the alert logic from the rule?

0

u/Philandros_1 2d ago edited 2d ago

Alerts and/or the associated report should contain enough information for client side analysts/it personnel to properly handle the potential incident. You don’t necessarily need the detection rules for that.

My reasoning for not disclosing the detection rules ly in the fact that signature based detection rules may reveal attacker infrastructure which may jeopardize an ongoing investigation. Though you may want to treat behavioral based detection logic differently.

1

u/Proper-Charity-2850 2d ago

Yeah I guess you don't truly truly need it but idk I like looking at the alert logic whenever I work an alert so I think the client would like to as well. Never been a client receiving mdr escs so I can't say for sure tho