Question

A SecOps engineer discovers that a critical firewall vendor's log field, 'threat_signature_id', was never mapped to UDM by the existing custom parser. Six months of these logs are already ingested. The security team now needs this field populated in UDM so detection rules can reference it going forward, but they also want the historical events to reflect the new mapping. Which approach correctly meets both requirements?

Accepted Answer

Update the parser with a parser extension to map 'threat_signature_id'; new events will use it immediately, but historical events must be re-ingested from the original raw logs to be reparsed with the updated mapping.

Answer

Update the parser extension; SecOps automatically retroactively reparses all previously ingested events, so both historical and new events reflect the mapping.

Answer

Create a reference list containing the signature IDs; SecOps will backfill the UDM field for both historical and future events using the list.

Answer

Submit a new log type request so the vendor's logs are reparsed under a fresh schema that includes the field for all stored events.