What is a parser in Google SecOps?

A parser is the component responsible for transforming a raw log — in whatever format its source system produces, whether that's a structured JSON payload or an unstructured syslog line — into normalized UDM fields as it's ingested into Google SecOps.

Google maintains a large catalog of over 700 pre-built parsers covering common log sources (firewalls, cloud platforms, identity providers, endpoint agents), so most standard log types are normalized automatically without a customer needing to write their own parsing logic; custom parsers can also be authored for proprietary or unusual log formats that don't have existing coverage.

Because parsing determines exactly which raw log fields map to which UDM fields, parser quality directly affects detection quality downstream: a poorly mapped parser can leave important fields empty or mismapped, which in turn means detection rules and searches referencing those fields silently miss events they should have caught, even though the raw log data itself was successfully ingested.