Question

A security operations engineer is evaluating the effectiveness of a newly onboarded firewall log source in Google SecOps. The logs are being ingested successfully and appear in raw log search, but analysts report that YARA-L detection rules referencing fields like principal.ip and target.port are not triggering, even though the underlying activity is present in the raw data. The engineer confirms the correct parser exists but suspects a coverage problem. What is the MOST likely root cause and appropriate corrective action?

Accepted Answer

The parser is failing to map the relevant raw fields into the UDM schema; review parser extraction logic and validate UDM field mappings so detections can reference normalized fields.

Answer

The data retention tier is too short; increase retention so the events remain available long enough for rules to evaluate them.

Answer

The analysts lack the correct data RBAC scope; grant them access to the firewall log label so their rules can see the events.

Answer

The forwarder is dropping packets during ingestion; switch to a webhook-based ingestion method to guarantee delivery.