Question

A Security Operations Engineer notices that a newly onboarded firewall log source in Google SecOps shows a high volume of events landing in the parser error/validation error state rather than being normalized into UDM. The raw logs are arriving successfully and feed health is green. Detections that depend on this source are not firing. What is the MOST appropriate first action to restore normalized data flow?

Accepted Answer

Inspect the parser error samples to identify the failing log format, then adjust the parser (or add a parser extension) so the malformed fields are correctly mapped to UDM

Answer

Increase the data retention period for the log source so the failed events are preserved longer for later reprocessing

Answer

Reconfigure the forwarder to send the logs to a different, already-working log type so they parse under that schema

Answer

Disable the affected detection rules until the vendor releases an updated log format