Seems to me like the value of a threat detection platform would be the detections themselves. With just the platform, and no detections, you have a foundation but the bulk of the work hasn't been started yet. If you're large enough to need a threat detection platform, you're probably large enough to be able to afford a product that has security engineers behind it constantly pumping out new detections for novel vulnerabilities.