SIEM Investigation Search Not Returning Results for MANDIANT_ACTIVE_BREACH_IOC

MANDIANT_ACTIVE_BREACH_IOC matches will show, but it is not directly searchable.

​@cmorris , thank you for your reply. so it means that I can only see the IOCs inside Alerts & IOCs tab and will never be able to search them via SIEM search ? secondly, Can I make detection rules using MANDIANT_ACTIVE_BREACH_IOC  or not ?

​@cmorris thanks again for your quick support. Will this limitation on MANDIANT_ACTIVE_BREACH_IOC is intentional or it is a limitation in the Google Secops product ? Further, What google recommends about the effective way of monitoring this feed other then watching the IOC matches in alert and IOCs tab. 

Intentional - Curated Detections use it.

Question on this, does this mean the documentation here is wrong? I could have sworn I was able to search it when this feature came out initally.

https://docs.cloud.google.com/chronicle/docs/investigation/entity-context-in-search#access_control_considerations

The following sources provide global context support:

• Safe Browsing
• VirusTotal Relationships
• WHOIS
• Uppercase
• Open Source Intel IOC (OPEN_SOURCE_INTEL_IOC)
• Mandiant Active Breach IoC (MANDIANT_ACTIVE_BREACH_IOC)
• Mandiant Fusion IoC (MANDIANT_FUSION_IOC)

​@cmerchant - Thank you, I filed a documentation bug earlier to have this corrected.

​@cmorris , thank you for you quick support for the community? I wanted to ask, Is there any way to store the matched IOCs in reference set automatically ? or the only option currently is to export the data in csv ?