What are curated detections?

Curated detections are pre-built, out-of-the-box detection rules authored and continuously maintained by Google and Mandiant security experts, covering common on-premises and cloud threat patterns without requiring a customer's own team to write and maintain that detection logic themselves.

Each curated detection is generally mapped to the MITRE ATT&CK framework, tagging which specific adversary tactic or technique it's designed to catch, which helps a security team understand their detection coverage against a recognized, standardized taxonomy of attacker behavior rather than an ad hoc, internally-invented classification.

Beyond routine coverage, some curated detection rule packs are specifically authored by Mandiant experts in response to newly identified threat actor activity or emerging tactics observed during real-world incident response engagements, meaning customers benefit from frontline threat intelligence being translated into deployable detection logic without needing to author or update those rules themselves as the threat landscape evolves.