Onboarding logs from a third-party DNS filtering solution, key UDM fields are missing. What should you do to enable downstream detection rules?

• A. Modify ingestion source definition to remap raw fields directly to UDM.
• B. Enable asset enrichment to infer missing fields.
• C. Use a custom parser that outputs raw JSON.
• D. Create a parser extension mapping missing source fields to correct UDM and attach to existing parser.

Answer: (D)

When downstream detection rules run, they expect events to be structured according to the Unified Data Model (UDM). If onboarding logs from a third-party DNS filtering solution miss key UDM fields, the right fix is to transform those events so they expose the correct UDM fields before the data reaches the rule engine. A parser extension lets you map the missing source fields to their corresponding UDM fields and attach this extension to the existing parser, ensuring every event produced by the parser uses the proper UDM schema. This approach keeps the ingestion flow consistent and adaptable to external log formats without rewriting ingestion or relying on guesswork.

Other options don’t fit as well. Remapping raw fields at ingestion can be brittle and bypasses the parser’s normalization, risking inconsistencies. Asset enrichment adds context but cannot guarantee the presence and correct typing of the necessary UDM fields. A custom parser that outputs raw JSON still doesn’t provide the explicit UDM field mappings that downstream rules require.