How does Applied Threat Intelligence work in Google SecOps?

Applied Threat Intelligence automatically applies curated threat intelligence — from Google, Mandiant, and VirusTotal — against every event ingested into Google SecOps, rather than requiring an analyst to manually check specific indicators against threat intel sources one at a time during an investigation.

As events are normalized, they're checked against curated, enriched intelligence sources — including things like Google Safe Browsing signals, known remote-access tool associations, and broader OSINT threat associations — and matching events get labeled with that context automatically, which can then feed into multi-event curated detections that correlate labeled activity across a broader pattern rather than relying on a single isolated indicator match.

This is what powers the platform's broader "detection funnel" concept: raw telemetry is first labeled with security context, then enriched with threat intelligence, then correlated via multi-event curated detections, ultimately producing a smaller, prioritized set of cases for analyst triage instead of an undifferentiated flood of raw alerts an analyst would otherwise need to manually sort through.