Question

A SecOps engineer needs to enrich firewall logs with the geographic country of the source IP so that detection rules can reference country codes directly in UDM fields. The organization wants this enrichment applied automatically to all events of this log type without maintaining a separate lookup mechanism per rule. Google SecOps already provides built-in GeoIP data. What is the recommended way to make the country code available for detection logic?

Accepted Answer

Rely on SecOps native enrichment, which adds GeoIP context to the principal and target IP fields at ingestion, and reference the enriched geolocation fields in rules

Answer

Build a custom CBN parser that performs an external GeoIP API call for each event and writes the country into a UDM extension field

Answer

Create a reference list of every public IP range mapped to a country code and match against it inside each detection rule

Answer

Configure the log forwarder to append the country code to the raw syslog message before it reaches SecOps