What is the difference between Google SecOps' detection engine tiers?

Google SecOps is offered in different packages that scale the detection engine's capacity and threat intelligence access, letting organizations choose a tier that matches their scale and depth of coverage needs — the exact limits and included features are part of Google's published, versioned pricing/packaging and can change over time, so specifics should always be verified against current official documentation rather than assumed to be fixed.

Generally, entry-level packages include core ingestion, detection, investigation, and response capabilities with a smaller detection engine capacity (a bounded number of single-event and multi-event rules) and a curated subset of Google's out-of-the-box detections, while higher tiers expand the number of concurrent detection rules supported, unlock the full curated detection catalog, and add deeper Google Threat Intelligence access — including emerging threat detections drawn from Mandiant's primary research and frontline incident-response findings.

Because these tiers and their specific limits are commercial packaging decisions rather than fixed technical constraints of the platform itself, the practical guidance for evaluating them is to check Google's current, published packaging details directly rather than relying on any single fixed number, since Google has adjusted tier boundaries and inclusions as the product has evolved.