CAN WE STOP DOCUMENTING OUR DETECTIONS?

Summary from the TLDR InfoSec newsletter

Documentation is important for detections to explain to SOC analysts what the rule detects, how to investigate the alert, any necessary enrichments, how to identify a false positive, and any necessary steps if it is a true positive. This post compares documentation with rules generated by LLMs to those written by humans using examples from Elastic's open-source rule sets. The evaluation found that roughly 60% of investigative steps provided by the LLM matched human-created ones, but also noted that humans tended to provide a larger number of detailed investigative steps.