A firewall parser fails to recognize fields after a patch introduces a new field and renames another. Which approach minimizes change management impact while restoring parsing capability?

• A. Write a code snippet and deploy in a parser extension.
• B. Copy and modify the parser via custom parser feature.
• C. Use Extract Additional Fields tool to convert raw entries to additional fields.
• D. Deploy a third-party pipeline to transform fields to supported formats.

Answer: (C)

When a firewall patch changes the log schema, the goal is to restore visibility without touching the core parsing logic. The best approach is to add an ingestion-time field extraction step that converts what’s present in the raw log into fields the parser already understands. Using the Extract Additional Fields tool lets you pull out the new field values and map or surface them as additional fields, so the existing parser and its rules keep working while you gain access to the new information. This is a low-risk, low-change-management change: it’s configuration-driven, can be rolled back easily, and doesn’t require rewriting the parser or adding complex pipelines. It also minimizes disruption to dashboards, alerts, and downstream analytics because you’re simply presenting the needed data in a compatible format.

In contrast, modifying or extending the parser itself, or introducing a separate third-party pipeline, would involve more invasive changes, greater testing, and longer deployment cycles, increasing risk and operational overhead.