Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ34

Data management

Your organization’s Google Security Operations (SecOps) tenant ingests a vendor’s firewall logs in the default JSON format by using the Google-provided parser for that log. The vendor recently released a patch that adds a new field and renames an existing field in the logs. The parser does not recognize these two fields, so they remain available only in the raw logs, while the rest of the log continues to parse normally. You need to resolve this logging issue as soon as possible while minimizing the overall change-management impact. What should you do?

  • A Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
  • B Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
  • C Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
  • D Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
Explanation

Google SecOps Auto Extraction, accessed through Extract Additional Fields, is intended for structured JSON or XML logs that already use an existing parser but contain unmapped fields. It dynamically identifies and extracts those raw fields to enrich the UDM record without changing or replacing the base parser, minimizing operational and change-management impact.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!