1. A computer-implemented method of providing a rule to detect malicious activity, the computer-implemented method comprising: receiving, by processing circuitry and from a first malicious activity detection system, an indication of whether a malicious activity detection rule is effective when used in the first malicious activity detection system to detect malicious activity, the received indication including a numerical rating value, a high numerical rating value indicating that the malicious activity detection rule is effective when used in the first malicious activity detection system to detect malicious activity; performing a numerical rating prediction operation to produce predicted numerical rating values indicating whether the malicious activity detection rule is predicted to be effective in other malicious activity detection systems that have not indicated using the malicious activity detection rule, the predicted numerical rating values including a predicted numerical rating value, the other malicious activity detection systems including a second malicious activity detection system; based on the indication, locating, by the processing circuitry, the second malicious activity detection system in which the malicious activity detection rule is predicted to be effective in detecting malicious activity, the locating of the second malicious activity detection system including comparing each of the predicted numerical rating values to a threshold rating value, the predicted numerical rating value indicating whether the malicious activity detection rule is predicted to be effective in the second malicious activity detection system exceeding the threshold rating value; initiating transmitting, by the predicted numerical rating value exceeding the threshold rating value, a message to the second malicious activity detection system recommending the malicious activity detection rule for use in the second malicious activity detection system to detect malicious activity, wherein each of the first malicious activity detection system and the other malicious activity detection systems is described by a respective one of a finite number of system descriptors, wherein the malicious activity detection rule is described by one of a finite number of rule descriptors, and wherein the performing of the numerical rating prediction operation includes: deriving, from the numerical rating value received from the first malicious activity detection system, (i) the respective system descriptor of each of the first malicious activity detection system and the other malicious activity detection systems and (ii) the rule descriptor of the malicious activity detection rule; and generating the predicted numerical rating values based on the derived system descriptors and the derived rule descriptor, the generated predicted numerical rating values including a generated predicted numerical rating value; and initiating detecting, by the generated predicted numerical rating value exceeding the threshold rating value, malicious activity by the second malicious activity detection system using the malicious activity detection rule.