Question

Your organization ingests firewall logs from a vendor that has a built-in default parser in Google SecOps. After a firmware upgrade, the vendor added three new fields to its log format that carry important threat context (application category, user identity, and TLS version). The default parser ignores these new fields, and you cannot modify Google-managed default parsers directly. Detection engineers need these fields normalized into UDM without disrupting the existing, working default parser mappings. What is the most appropriate approach?

Accepted Answer

Create a parser extension for that log type to map the three new fields into the appropriate UDM fields while the default parser continues handling the existing fields

Answer

Fork the default parser into a fully custom parser, re-implement all existing mappings, and add the new field mappings, then override the default

Answer

Open a support case asking Google to update the default parser, and pause ingestion of the firewall logs until the update is released

Answer

Store the raw logs unparsed and use search-time field extraction whenever detection engineers need the new fields