Adding blank entities to parser to be filled in by IDE

[bvenn]

I want to add blank parser fields so that I can go through later using a script made with SecOps in the IDE to map custom identifiers to those blank fields. Is there any way to do this?

[matthewnichols]

Hi @bvenn Thank you for your post. Can you share with us a little more around what you are trying to accomplish?

[matthewnichols]

@bvenn The schema we have in UDM for events is very extensible and we will consider adding additional fields upon request if they are unique. However, unlike other schemas, CEF comes to mind, that have custom fields that are ambiguous, UDM does not have them. That said, in addition to the UDM field list found here, https://cloud.google.com/chronicle/docs/reference/udm-field-list, if we needed a place to store data where it would not fit anywhere else, something like the noun of about in the schema is worth looking into and using the concept of labels which is essentially key value pairs. That might be something to consider if you are looking to store data in the UDM SIEM schema if it doesn't go anywhere else.

Let us know if that helps. Thanks