Question

A security operations engineer is onboarding a new firewall vendor into Google SecOps. The vendor produces high-volume traffic logs, but no default parser exists for this exact product, and the team has not yet built a custom parser. Leadership requires that these logs be searchable and retained immediately for a compliance audit next week, while detection engineers work on parsing in parallel. Which ingestion approach best satisfies the immediate requirement without blocking future normalization?

Accepted Answer

Ingest the raw logs now so they are stored and searchable via raw log scan, then apply a custom parser later once developed; reparsing can normalize historical data.

Answer

Ingest the logs with a log type set to a similar existing firewall parser so events are forced into UDM immediately.

Answer

Delay all ingestion until the custom parser is complete to avoid storing unnormalized events that cannot be queried.

Answer

Ingest the logs into a separate data lake outside SecOps and import only parsed events after the parser is finished.