A detection with no owner decays
Unowned rules do not fail loudly, they drift. Ownership answers who reviews the rule when the thing underneath it changes.
Rules are written by people who leave. The rules stay.
An unowned detection does not fail loudly. It drifts. The log source it reads gets replaced in a migration and nobody maps the fields across. An exclusion added for one noisy host in 2024 is still there. The tool it was written for was decommissioned last year and the rule now matches nothing, forever. Every one of those is a small, reasonable act by somebody who did not know the rule existed.
Ownership is not about blame. It answers three operational questions: who reviews this when the log source changes, who decides whether an exclusion is still justified, and who gets asked before it is switched off. With no name attached, all three default to nobody, and nobody is a dependable answerer only in the sense that the answer never varies.
Put the owner in the rule, beside the logic, in the file that goes through review. A team name outlives a person and is usually the right granularity. Add a review date while you are in there, because ownership without a schedule is just a populated field.
Open ten rules at random and count how many name someone. If you cannot fill that field for a rule, fix that before you touch its logic.
CHECK YOURSELF
A migration moves your endpoint process events to a new log source with different field names. Which rules are most likely to break quietly?
SHOW THE ANSWER
Rules with nobody listed as owner, because nobody reviews them against the new fields
Why. Volume and complexity make a break easier to notice rather than more likely. A loud rule going silent gets spotted, and complicated logic attracts attention during a migration precisely because people expect it to be fragile. The risk sits with rules nobody is responsible for, because a migration gets worked through a list and rules with no name attached never make the list. They carry on querying fields that no longer exist and reporting nothing.