Question

Your SOC maintains a curated inventory of business-critical server hostnames and their asset owners in a spreadsheet. Analysts want detections and searches in Google SecOps to automatically flag events involving these critical assets and surface the owning team, without modifying the raw logs or rewriting parsers for every log source. Which approach best meets this requirement?

Accepted Answer

Import the inventory as a reference list (data table) and correlate it against UDM fields in YARA-L rules and searches to enrich and match events at query time.

Answer

Add the hostnames and owners as static string literals inside each parser's Logstash configuration so the values are written into every event.

Answer

Create a separate log source that ingests the spreadsheet daily and rely on analysts to manually join it with security events.

Answer

Increase the data retention period for the affected log sources so the asset context is preserved longer.