A security operations engineer notices that detection rules referencing a custom-parsed firewall log source are firing with incorrect time windows. Investigation shows that the parser maps the log's collection time rather than the actual firewall event time into the UDM 'metadata.event_timestamp' field. Detections that correlate events across a 10-minute sliding window are producing false negatives because events appear clustered at ingestion time. What is the most appropriate corrective action?