Records buyers look for
- Alert triage decisions and rationales
- Investigation notes and timelines
- Incident reports and post-mortems
- Detection rules with their tuning history
Why AI buyers want them
Security reasoning is learned on the job and rarely written up publicly. Analyst decisions linked to outcomes are valuable for training security agents.
What to check first
- Client environments, indicators and credentials must be removed.
- Client contracts and NDAs may restrict reuse.
- Avoid anything that could help attackers.
You’re likely a fit if
- You run a SOC, MDR or incident-response practice
- Cases are documented consistently
- Clients’ data can be sanitized or consent obtained
Frequently asked questions
Can an MSSP license client incident data?
Only after removing client-identifying details and checking contracts. Your own methods and write-ups are easier to license.