Question

Your organization ingests logs from a niche network access control (NAC) appliance that Google SecOps does not have a default parser for. The appliance emits well-structured JSON, and your detection engineers need the events searchable in UDM within the current sprint. The SecOps admin asks how to establish reliable parsing for this source with the least long-term maintenance burden while ensuring the data is normalized correctly. What is the most appropriate approach?

Accepted Answer

Create a custom parser (parser code) for the NAC log type that maps the JSON fields to the appropriate UDM fields, then validate it against sample logs before promoting it to production.

Answer

Ingest the logs as raw text only and rely on raw log search, deferring UDM mapping until Google publishes a default parser for the appliance.

Answer

Apply a parser extension to the closest existing default parser for a different vendor's NAC product to reuse its UDM mappings.

Answer

Configure a reference list containing the NAC field names so that enrichment can populate UDM fields at query time instead of at ingestion.