Question

A security engineer onboards a new firewall vendor whose syslog output does not match any built-in Google SecOps log type. Ingestion is currently succeeding, but events land under a generic/unstructured log type and analysts complain that UDM fields like principal.ip, target.ip, and security_result.action are empty, breaking existing detection rules. The engineer wants events to populate these UDM fields correctly with the least long-term maintenance burden. What is the most appropriate action?

Accepted Answer

Submit a request to Google Cloud to create a new dedicated log type and parser for the vendor, then reconfigure the forwarder to tag events with that log type

Answer

Leave the events under the generic log type and rewrite all affected detection rules to search the raw log text instead of UDM fields

Answer

Increase the data retention tier for the generic log type so historical events remain searchable while fields stay unmapped

Answer

Apply a parser extension to the generic log type to overlay the vendor-specific field mappings on top of the unstructured events