I've been tasked with evaluating our SOC's tooling spend, and we've been running a proof-of-concept for Google Chronicle for the last 90 days. Our primary use case was leveraging its threat intelligence to reduce alert fatigue and prioritize incidents specific to our industry (specialized manufacturing with proprietary operational technology).
The conclusion is stark: we are not proceeding with the license. The core issue is the generic nature of the bundled threat intelligence feeds. While the volume of IOCs is impressive, the signal-to-noise ratio for our environment is unacceptable.
To quantify the problem:
* Over the 90-day period, Chronicle generated **1,247 "high-fidelity" alerts** flagged with threat intelligence matches.
* Manual review found **only 17** were relevant to our software stack, industrial control systems, or supply chain partners.
* That's a **1.36% relevance rate**. The rest were related to consumer-grade malware, broad commodity ransomware, and politically motivated hacktivist activity targeting sectors we have no exposure to.
This isn't a problem with the detection engine itself, but with the intel. We configured a custom list of our critical assets and applied Chronicle's default rules. The logs were ingested correctly, but the matches were meaningless. For example, an alert triggered because a known C2 domain (from a campaign targeting financial services) appeared in a proxy log—for an internal machine that was querying a blocked domain for a typo-squatted analytics SDK used only in mobile apps we don't deploy.
The cost implication is the real killer. At its projected annual commitment, we'd be paying a premium for threat intelligence that delivers negligible operational value for our vertical. We've found more success—and cost control—by:
1. Subscribing to two niche, vertical-specific threat intel feeds.
2. Ingesting them into our existing SIEM.
3. Writing targeted detection rules.
The TCO for that approach is approximately 22% of the Chronicle quote, and the relevance rate of alerts has jumped to over 60%. Chronicle is a powerful platform, but if your threat landscape is specialized, the out-of-the-box intel may be a costly mismatch. I'm interested if other teams in specialized verticals (industrial, agriculture, specialized logistics) have had similar experiences or found effective ways to tailor the intel within Chronicle to justify its cost structure.
Right-size or die
That 1.36% hit rate is a brutal but perfect piece of evidence. I'm not surprised. The problem isn't just the generic feeds, it's that vendors sell "comprehensive" intel as a blanket feature, when it's mostly just background noise for anyone outside the tech/finance/retail mainstream.
You've isolated the exact failure mode: a detection engine waiting for relevant data. It's like having a world-class smoke detector that's constantly triggered by someone, somewhere, lighting a cigar. Your team just spent 90 days confirming it's a cigar factory in another country.
The real question your numbers pose is for any vendor: do you charge a premium for that 98.64% waste? Because I bet the quote they sent you wasn't discounted by that percentage.
Your free trial ends today.
Your quantification is excellent, but I'd push back slightly on framing it as purely an "intel" problem. It's also a data enrichment and filtering problem at its core.
The detection engine and the intel feed are two separate data streams. The chronicle platform should, in theory, allow you to build context-aware lists that act as a filter *before* the alerting stage. Did your team attempt to create suppression lists based on your asset inventory and observed network traffic patterns? A high volume of generic IOCs hitting a perimeter asset is one thing, but that same IOC observed in a segment containing your OT controllers should be an entirely different severity.
The failure might be in the tool's inability to apply your operational context efficiently, not just the intel's source. That 1.36% could be the ceiling for any off-the-shelf SIEM if you don't build a heavy, custom filtering layer on top.
--perf