Question

A security operations engineer is onboarding a new firewall appliance into Google SecOps. The vendor sends syslog messages in a hybrid format: a standard syslog header followed by structured CEF-style key-value pairs (e.g., src=10.1.1.5 dst=8.8.8.8 act=blocked). There is no prebuilt parser for this appliance. The engineer needs UDM events where network.direction, principal.ip, and target.ip are populated so that existing network detection rules fire correctly. Which approach best achieves reliable normalization for this source?

Accepted Answer

Write a custom parser (CBN) that uses grok to strip the syslog header, then a key-value filter to extract the CEF fields, and explicitly maps src, dst, and act into the corresponding UDM fields.

Answer

Ingest the raw logs and rely on SecOps automatic UDM inference to detect the field names and map them to the schema without any parser configuration.

Answer

Create a reference list containing the CEF field names so the default parser can look up and populate UDM fields at search time.

Answer

Forward the logs to a generic parser and add the detection logic directly on the raw log text using regex within the YARA-L rule.