Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ71

Data management

You are managing a Google Security Operations (SecOps) implementation for a regional customer. The customer tells you that logs are showing up in the platform after a consistent six-hour delay. After researching, you determine that a log time-zone issue is responsible. You want to resolve this problem. What should you do?

  • A Modify the default parser and include a default time zone.
  • B Create a parser extension to correct the time zone.
  • C Create a custom parser to correct the time zone.
  • D Modify the UI settings to correct the time zone.
Explanation

A parser extension is the appropriate way to customize an existing default parser without replacing it. Its code-snippet syntax supports timestamp and time-zone handling, allowing the event-time interpretation to be corrected. UI time-zone preferences do not correct parsed log timestamps, and custom parsers are intended when no suitable default parser exists or when replacing it is required.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!