Question

A SecOps parser engineer is authoring a custom parser for a new authentication appliance. The raw logs contain successful and failed interactive logins. Detection engineers report that rules referencing USER_LOGIN events never match this source, even though the parser runs without errors and populates principal and target fields correctly. Which parser configuration is the most likely root cause?

Accepted Answer

The parser does not set metadata.event_type to USER_LOGIN, so events are normalized to a generic type that the detection rules do not match.

Answer

The parser omits metadata.product_log_id, preventing SecOps from correlating raw logs to UDM events.

Answer

The parser uses event-time instead of ingestion-time for metadata.event_timestamp, so events fall outside the rule window.

Answer

The parser writes the login result to a custom extracted field rather than the security_result.action field, breaking enrichment.