Thread by @chrissanders88

This relates to my 4th and 5th reasons why these decisions happen -- AV company tactics and giving folks what they need to tune rules. That actually means GIVING analysts the rule logic. I could go on and on about this.

https://twitter.com/shotgunner101/status/1408076677972901891

Most companies don't want to give out their rule logic because they see it as a sensitive trade secret. This is nonsense. A rule set isn't a detection companies most valuable intellectual property, it's their processes for creating those rules and the staff that do the work.

Limiting access to detection logic makes it harder for your customer. It is MUCH more difficult to investigate alerts when you don't know what they are actually detecting and how they're doing it.

It also hurts the vendor's detection engineering team, too. Without exposing the logic, you limit your customer's ability to provide feedback on the rule and make it better.

At a prior job, my favorite thing was customers reaching out and telling us there was a problem with a specific part of our rule. They were doing my work for me and everyone got to benefit.

I have had to fight tooth and nail at some places to get them to expose rule logic, and it was a CONSTANT battle.

You'll even find places that share some rules, but also have special types of rules so that they can set a flag or compile the rule and not expose logic.

Let's also be real here -- some vendors don't expose rule logic because they don't want to open themselves up to criticism or feedback. They avoid that.

The best thing I can recommend here is to limit who you do business with if they can't tell you why their tool detected something when they present an alert. Make sure they know why. This sorta thing mostly exists because people allow it to.

BTW -- Even the fancy behavioral stuff isn't super secret -- most vendors have patents on it. You can look it up yourself, but you shouldn't have to do that.