Question

A Security Operations Engineer is onboarding logs from a network appliance that emits two structurally different message formats over the same syslog stream: one for firewall traffic events and one for VPN session events. Both arrive tagged with the same log source and are currently ingested under a single log type. The default parser correctly normalizes the firewall messages but drops the VPN messages as parse errors. The team needs both event categories reliably normalized into UDM without impacting the working firewall normalization. What is the most appropriate approach?

Accepted Answer

Split the ingestion so VPN messages are routed to a separate, dedicated log type with its own parser, keeping the firewall log type and its default parser unchanged.

Answer

Disable the default parser for the shared log type and rely on raw log search until the vendor consolidates its message format.

Answer

Increase the data retention tier for the shared log type so the dropped VPN messages can be reprocessed later automatically.

Answer

Add a reference list containing VPN session keywords so the enrichment pipeline can normalize the dropped messages after ingestion.