Question

A security engineer at a logistics company ingests DHCP lease logs into Google SecOps. The parser correctly extracts the client MAC address and assigned IP into UDM fields. However, analysts complain that events lack the hostname and asset owner, which are maintained in an external CMDB and are needed for triage. The engineer wants asset owner and hostname to appear on the DHCP events without modifying the raw logs or the vendor's export. Which approach correctly satisfies this requirement in Google SecOps?

Accepted Answer

Configure entity context ingestion (context/entity data) so the CMDB asset attributes are joined to events at search and detection time via UDM enrichment

Answer

Rewrite the DHCP parser to make an outbound API call to the CMDB for each log line and write the hostname and owner into UDM fields during parsing

Answer

Create a reference list of MAC addresses and place the asset owner values directly into the raw DHCP log stream before ingestion

Answer

Increase the retention tier for the DHCP log type so the CMDB fields are automatically backfilled onto historical events