3

We investigate detection rule engineering by introducing SuriCap, a platform for rule engineering exercises, and hosting CTF-style workshops where 60 participants created rules for four scenarios. Surprisingly, prior experience had limited impact on rule quality, suggesting that less experienced engineers can produce rules comparable to experts.