QuestionQ5

VerifiedParsing and Normalization

You are onboarding a log source that contains a timestamp in a different timezone.

How should you address any time-parsing errors that arise?

Explanation

A custom parser should apply the appropriate timezone parameter when parsing the log timestamp, so the event time is interpreted correctly. Cloning the parser allows that timezone-specific change while retaining the original parser. Google Security Operations supports a timezone parameter in its date parsing function.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!