Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ129

Data management

Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you find that key UDM fields, including network.dns.questions.name and metadata.product_event_type, are absent from the parsed events in Google Security Operations (SecOps). You suspect the default parser does not fully match the source format. You need to make sure these fields are available for downstream detection rules that depend on DNS query telemetry and event categorization. What should you do?

  • A Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
  • B Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
  • C Use a custom parser that outputs all fields as raw JSON for detection.
  • D Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
Explanation

A parser extension augments the existing default parser by extracting values from the raw source logs and mapping them to the appropriate UDM fields. Once activated, its mappings are merged into the UDM record, making the DNS query name and product event type available to detections.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!