nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #73

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently…

The correct answer is D. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to. The quickest and lowest-impact solution is to use the Extract Additional Fields tool in Google SecOps. This allows you to map the new and renamed fields from the raw logs into UDM fields without modifying the default parser or deploying custom code, ensuring the logs are fully…

Managing data ingestion and parsing

Question

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

Options

  • AWrite a code snippet, and deploy it in a parser extension to map both fields to UDM.
  • BUse the web interface-based custom parser feature in Google SecOps to copy the parser, and
  • CDeploy a third-party data pipeline management tool to ingest the logs, and transform the updated
  • DUse the Extract Additional Fields tool in Google SecOps to convert the raw log entries to

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    6% (2)
  • C
    3% (1)
  • D
    81% (25)

Explanation

The quickest and lowest-impact solution is to use the Extract Additional Fields tool in Google SecOps. This allows you to map the new and renamed fields from the raw logs into UDM fields without modifying the default parser or deploying custom code, ensuring the logs are fully parsed and available for downstream detections.

Topics

#parser extension#UDM field remapping#firewall log update#minimal change management

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice