Question

Your SOC is onboarding a new SaaS collaboration platform into Google SecOps. The vendor already appears in Google SecOps as a supported, out-of-the-box (default parser) log source with a documented ingestion API. A detection engineer proposes writing a custom parser from scratch and building a bespoke ingestion pipeline because the team wrote custom parsers for previous integrations. Considering platform operations efficiency and long-term maintainability, what should you recommend?

Accepted Answer

Use the vendor's supported out-of-the-box default parser and native ingestion path, reserving custom parsing only for fields the default parser leaves unmapped.

Answer

Build the custom parser from scratch to maintain consistency with how previous integrations were handled.

Answer

Forward the logs to Cloud IDS first so it can normalize them before SecOps ingestion.

Answer

Skip SecOps ingestion entirely and rely on the SaaS vendor's own console for detection.