Question

Your organization forwards logs from a niche in-house web application firewall to Google SecOps. The logs arrive successfully, but analysts report that key fields such as source IP, blocked URL, and rule ID appear only as raw text and cannot be searched or used in detection rules. There is no default parser for this custom log format. What is the most appropriate action to make these fields usable in searches and rules?

Accepted Answer

Create a custom parser that maps the vendor's raw log fields to the appropriate Unified Data Model (UDM) fields.

Answer

Increase the data retention period so the raw logs remain available longer for manual review.

Answer

Configure a reference list containing the expected source IPs so detections can match against them.

Answer

Change the ingestion label so the logs are routed to a different existing parser for a similar product.