Question

Your SOC uses a Google SecOps default parser for a firewall vendor's logs, but the vendor recently added a proprietary threat-verdict field that the default parser does not map. You author a parser extension to map this field into a UDM security_result field. Two weeks later, Google publishes an updated release of the default parser that adds native mapping for several other new fields but still does not include the threat-verdict field. What happens to your parser extension after the default parser update, and what should you verify?

Accepted Answer

Parser extensions are automatically applied on top of the updated default parser, but you must validate that the extension's referenced fields and mappings remain compatible with the new default parser version.

Answer

The default parser update overwrites and deletes all parser extensions, so you must re-author the extension from scratch after every Google-published parser release.

Answer

Parser extensions are frozen against the parser version they were created on, so the extension will silently stop applying until you manually re-point it at the new default parser version.

Answer

The extension is promoted into the default parser automatically because Google merges customer extensions into published releases during each update cycle.