Question

A security engineer is onboarding a new SaaS application whose logs arrive in Google SecOps as a single JSON payload per API poll. Each payload contains a top-level metadata object and an 'events' array where each array element represents a distinct user activity that should become its own UDM event. After deploying a standard parser, the team notices only one UDM event is generated per payload, and only the first array element's fields are populated. What is the most appropriate parser configuration approach to correctly produce one UDM event per activity?

Accepted Answer

Configure the parser to iterate over the 'events' array and emit a separate UDM event record for each array element, mapping fields from within each element.

Answer

Use a state machine within the parser that maps only the metadata object, since UDM does not support arrays.

Answer

Create a reference list containing each event type so the parser can look up and split the payload after ingestion.

Answer

Request that the SaaS vendor change the API to send one event per payload before onboarding proceeds.