Professional Security Operations EngineerDemo

Question

Your company recently began importing JSON logs from a third-party system into Google Security Operations (SecOps). You discovered that some fields are absent and want to parse them into UDM fields as quickly as possible. What should you do?

A Configure auto extraction to add the additional fields.
B Create parser extensions using the no-code approach.
C Create parser extensions using the code snippet approach.
D Submit a parser improvement request to Cloud Customer Care.

Explanation

For JSON logs, a no-code parser extension can map raw JSON field paths directly to destination UDM fields without writing parser code. Auto extraction stores values in the extracted map-type field rather than normalizing them into selected UDM fields. Google Security Operations parser extensions documentation

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ107

Community Discussion