CloudSOC is sold as one SKU for all basic CloudSOC Modules (audit, detect, securlets, gatelets, etc).
Usually CloudSOC is now sold as "DLP Cloud" SKU. DLP Cloud includes all CDS connections necessary for the Symantec Plugins (SWG and DLP Core).
VBA Macros/AV is already included but must be activated in settings, however Advanced Threat Protection is sold as an additional add on, same as Mirror Gateway.
-Olin