Question

A security operations team ingests high-volume Zeek connection logs into Google SecOps. Analysts complain that the raw per-connection events flood UDM search and inflate storage, yet most individual connection records are never referenced during investigations. Only aggregated session-level context and anomalous flows matter for detections. The team wants to reduce ingestion noise and cost while preserving the ability to hunt on meaningful network activity. Which approach best addresses this data management challenge?

Accepted Answer

Apply ingestion-time filtering and aggregation in the data pipeline to drop or summarize low-value connection records before they reach UDM, while forwarding anomalous or session-relevant flows for full normalization

Answer

Ingest every raw connection record unchanged and rely solely on shorter retention tiers to control cost

Answer

Disable the Zeek parser entirely and store the logs only as raw, unparsed text to avoid UDM inflation

Answer

Increase the search index size so all per-connection events return faster, eliminating the analyst performance complaints