Question

A SecOps engineer is onboarding a new firewall log source. The security team needs to run detections that identify blocked connections by source IP, destination IP, and action within the first week, but the vendor logs contain over 200 fields and building a complete custom parser will take several sprints. What is the most effective approach to deliver detection value quickly while planning for full coverage?

Accepted Answer

Configure a parser extension on the default parser to map the priority fields (source IP, destination IP, action, timestamp) to UDM now, then iteratively expand field coverage in later sprints

Answer

Delay ingestion of the firewall logs entirely until a complete custom parser mapping all 200 fields is developed and validated

Answer

Ingest the raw logs without any parser and rely solely on raw log search until the full parser is complete

Answer

Store the firewall logs in a low-cost retention tier and disable normalization to reduce ingestion cost during development