You know how cooking schools teach knife skills? There's a persistent belief that great knife work takes years of muscle memory, but studies show that after focused drills, a second-year student can julienne as fast and cleanly as a five-year sous chef. The gap everyone assumes exists between novice and expert turns out to be smaller than the gap between having good ingredients and not. This paper is that study, but for writing network intrusion detection rules. The committed claim: detection rule engineering for Suricata-style NIDS follows a discoverable, teachable three-phase process, and prior SOC experience does not substantially improve rule quality compared to trained-but-junior engineers. The authors built SuriCap, a custom platform for running rule-writing exercises like CTF challenges, deployed it to 60 participants split between MSc students and working SOC analysts, and collected 3,146 valid rules across four attack scenarios. That is an unusually rich empirical dataset for a domain where most knowledge lives in tribal lore and vendor documentation. The finding that experience barely moved the needle is the load-bearing result. SOC managers routinely gate rule-writing on seniority, treating it as artisanal knowledge. This paper suggests the real bottleneck is labeled data — participants struggled most when they had to generalize rules beyond the specific traffic samples available to them. That is a data problem, not a talent problem, and it reframes where SOCs should invest. More labeled attack traffic, not more years of seniority. Methodologically, this sits in the human-factors / empirical software engineering tradition — think of it as a controlled task study, not a systems paper. The 60-person sample is decent for this kind of work but not enormous. The four scenarios provide variety but we don't know how findings transfer to more exotic attack types. The three-phase pattern the authors identify (exploration, refinement, generalization) is descriptive, not experimentally validated as causal — it's observed from iteration logs, which is reasonable but leaves room for alternative explanations. The integrity picture is mixed. SuriCap is a novel instrument built by the authors, so the validation is partially circular: they designed the platform, ran the workshops, and analyzed the output. No independent replication exists. The participant pool mixes students and professionals, which is a strength for the experience comparison but introduces selection effects — SOC professionals who volunteer for a workshop may not be representative. The authors are honest about these limitations, which counts for something. The practical upside is clear and immediate. If you manage a SOC, this paper gives you a structured vocabulary for the rule-engineering process (three phases, common iteration patterns) and empirical backing for investing in junior engineers with good training and labeled data rather than exclusively hiring expensive senior analysts. The SuriCap platform itself, if released, could become a training tool. The gap this paper doesn't close: real-world rule quality is measured by detection rates against live adversaries, not workshop performance. The translation from CTF-style exercise to production SOC is the obvious next experiment, and it's the one that matters most.
