Question

A firewall vendor ships logs in CEF format, and your team maintains a parser extension that extracts several custom device-event fields into UDM. After a firmware upgrade, the vendor begins emitting a NEW CEF extension key (deviceCustomString5) carrying the threat category, while the older key it replaced still appears in logs from devices that have not yet been upgraded. Detection engineers need the threat category reliably mapped to security_result.category_details for BOTH firmware versions during the multi-month rollout. What is the most appropriate approach in Google SecOps?

Accepted Answer

Update the parser extension to conditionally map both the old and new CEF keys to security_result.category_details, so events from either firmware version normalize correctly during the rollout.

Answer

Request a brand-new log type for the upgraded firmware and route upgraded devices to it, keeping the original parser untouched for legacy devices.

Answer

Wait until the rollout completes, then modify the parser extension once to map only the new key, accepting a coverage gap for upgraded devices in the interim.

Answer

Add the new threat category as a reference list entry and enrich events post-ingestion instead of changing the parser.