A TRR documents the distinct procedures that implement a technique, including the background and technical information necessary to understand how those procedures work. TRRs provide the context, information, and potential telemetry needed to create a robust detection strategy tailored to your specific environment.

TRRs were created by Andrew VanVleet to define a structured format for comprehensive (instead of opportunistic) detection research. Building on the principles of Capability Abstraction defined by Jared Atkinson, and the subsequent schematization of procedures, TRRs seek to define all procedures within a given technique. This comprehensive knowledge gives defenders the ability to write detection validation tests and/or detection rules using the research.

Another reason for creating the TRRs is to ensure the detection context is recorded, not just the rule. The appropriate context helps detection engineers manage and tune the rule as environmental circumstances change.

TRRs are designed to be collaborative, since they establish data that can be used by any organization for their specific detection strategy. There is a contribution guide, detailed guide on TRR format, and a public library of completed TRRs that can be used today.

See also this blog post where Andrew describes the TRRs in more depth.