How can I get the most value from Google SecOps Enterprise only - especially from the threat intelligence side?

You can start with  the Applied Threat Intelligence  Curated Detection Rule Pack and adjust detection modes and alert thresholds to balance sensitivity and noise by combing custom YARA-L rules.
 

Example 1: Basic Domain Match (Any Network Activity Involving Mandiant Fusion Domains)

This rule detects any events where a domain matches a Mandiant Fusion IOC.
 

rule mandiant_fusion_domain_match {
  meta:
    description = "Detects domains matching Mandiant Fusion IOCs"
    severity = "HIGH"

  events:
    $fusion.graph.metadata.product_name = "MANDIANT_FUSION_IOC"
    $fusion.graph.metadata.vendor_name = "MANDIANT_FUSION_IOC"
    $fusion.graph.metadata.source_type = "GLOBAL_CONTEXT"
    $fusion.graph.metadata.entity_type = "DOMAIN_NAME"

    // Join Fusion domain to common UDM hostname fields (adapt based on your telemetry)
    $domain = $fusion.graph.entity.hostname
    strings.coalesce(
      $e.principal.hostname,
      $e.target.hostname,
      $e.network.dns.questions.name,
      $e.network.http.hostname
    ) = $domain

  match:
    $domain over 1d  // Adjusts time window as needed

  condition:
    $fusion and $e
}

​@Redteamlead 

Excuse me for interrupting.
I'm also interested in this topic. Is the Applied Threat Intelligence Curated Detection Rule Pack and Mandiant Fusion IOC information available for Google SecOps Enterprise?
I thought these were features only available for Enterprise+.

​@keiS  You are correct.  ATI is only available in Enterprise+

Please reference https://cloud.google.com/security/products/security-operations for some more detail

​@kentphelps Thank you for your response. I understand.

​@keiS ​@Redteamlead Take a look at this weeks announcement to see if this can help out:

• BYOL Threat Intelligence integration