Curated Rule pack details

Hi @ganeshsunkari ,

Here’s a general list:

• Chronicle Enterprise:
  Includes core curated rule packs like MITRE ATT&CK, basic threat detection, and compliance-focused packs.

• Chronicle Enterprise Plus:
  Includes everything in Enterprise plus additional curated packs such as:

  • VirusTotal Intelligence

  • GCTI feeds (SPUR, Remote Access Tools, Relationships)

  • Advanced threat detection

  • Customizable detection packs

  • Industry-specific packs (for finance, healthcare, etc.)

For the exact and up-to-date list, I recommend contacting your Google Cloud account rep or checking the official Chronicle documentation portal.

In Enterprise Plus, how can I access the specific intelligence from Spur?
we were told last year it's included under Secops’ out of the box entity graph GLOBAL_CONTEXT.
I am not able to find it.

Tried this so far:

(graph.metadata.vendor_name = /(?i)GTI_IOC|MANDIANT_FUSION_IOC|OPEN_SOURCE_INTEL_IOC|MANDIANT_ACTIVE_BREACH_IOC/ AND
(graph.metadata.threat.url_back_to_product = /(?i)spur/ AND graph.metadata.threat.url_back_to_product != /(?i)virustotal/))
OR (graph.metadata.product_name = /(?i)spur/ OR graph.metadata.vendor_name = /(?i)spur/)
OR (graph.metadata.product_name = "GCTI Feed" AND graph.metadata.feed = /(?i)spur/)

Looking for non-AI perspectives on this specific topic.