Trend template language, TTL, is considerably a new approach for describing computer intrusion events. Its inherent strength of linguistic constructs could help describe events more effectively which can help detection process overcome limitations of current intrusion detection techniques to detect attack trends. Some researches have been already conducted establishing the strength and possibilities of TTL as an event description language over some traditional approaches. This article goes further with TTL and dissects the possibilities and limitations of TTL and trend detection with practical view point.