Question

A SecOps engineer is designing enrichment for firewall logs already normalized into UDM. The security team wants analysts to be able to filter events by the geographic country of the source IP without maintaining a manually curated list of IP-to-country mappings. Which approach best satisfies this requirement using native Google SecOps capabilities?

Accepted Answer

Rely on Google SecOps' built-in IP geolocation enrichment, which automatically populates location fields in the UDM event during ingestion

Answer

Create a reference list containing every public IP range mapped to its country and reference it in each detection rule

Answer

Write a custom parser extension that performs an external DNS lookup on each source IP to resolve the country at parse time

Answer

Export the firewall logs to BigQuery and join them against a static country table before re-ingesting into SecOps