QuestionQ73
Data managementYou are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization uses a prebuilt parser to parse a complex, stable, and common log source. The parser is functioning correctly. However, your organization now wants you to modify the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?
- A Design and develop a custom parser.
- B Apply any pending updates to the prebuilt parser.
- C Implement a parser extension on top of the prebuilt parser.
- D Implement middleware to modify the underlying data structure.
Community Discussion