Question

A security operations engineer ingests logs from a widely-used firewall vendor that already has a Google SecOps-provided default parser. The engineer notices that a newly added custom field in the firewall's log format (introduced after a firmware upgrade) is not being extracted into UDM. The engineer wants to capture this new field while keeping the reliability and future maintenance benefits of Google's managed parser. What is the most appropriate approach?

Accepted Answer

Create a parser extension on top of the default parser to map only the new custom field, leaving the base default parser managed by Google

Answer

Copy the default parser into a full custom parser override, modify it to add the new field, and disable the default parser

Answer

Open a support case and wait for Google to update the default parser before ingesting any of the firewall logs

Answer

Route the firewall logs to a generic JSON parser so all fields, including the new one, are captured without mapping