That kind of depends. The software could easily be published without publishing the rules/models that are being run. While knowing what sort of parameters are available to the rules/models might make it easier to identify attacks that aren't going to be found, that's not a given.