Did you see Google is sunsetting the legacy threat intel feeds?

Hey everyone, I was digging through the Chronicle release notes this morning and saw the announcement about sunsetting the legacy threat intel feeds on October 1, 2024. It looks like they're moving everyone fully over to the newer "Threat Intelligence" content sources.

For those of us using Chronicle for our SOC workflows, this seems like a significant change. I've been using the legacy feeds for a while, mainly pulling IOCs into our detection rules. My immediate questions are:

* What's the actual migration path? The docs mention it's "automatic," but I'm curious about the data mapping. Will all our existing rules and references to the old feed names just work?
* Has anyone already been switched over to the new feeds? I'm wondering about differences in volume, update frequency, or the types of indicators provided.
* This seems like a good time to audit our detection logic. I'm planning to check our Terraform configs for any hardcoded references.

Here's a snippet of how we currently reference a feed in our Terraform module for a detection rule:

```hcl
resource "chronicle_detection_rule" "suspicious_executable" {
display_name = "Known Malicious Hash Execution"
# This uses the legacy feed name
threat_indicator {
feed_id = "LEGACY_MALWARE_HASHES"
}
...
}
```

I'll need to update the `feed_id` to the new source identifier. I'm also slightly concerned about potential cost implications if the new feeds generate more or different alert volume.

Has anyone started this migration yet? Any pitfalls or observations to share, especially regarding your existing detection coverage?

-- Amy