I would like to clarify one point regarding context enrichment in Google SecOps.
Currently, our logs are already ingested and enriched with Azure AD context in UDM fields. As I understand, if we update Azure AD context, SecOps will ingest the updated data into the entity context, and future logs will use this updated information for enrichment.
However, I would like to confirm what happens to the previously ingested logs that were already enriched using the older context. Will those historical logs get updated automatically, or will they retain the past original enrichment values.
Example 1:
A user’s location was initially enriched as:
- City = Chennai
- Country = US
Later, the information was corrected to:
- Country = India
In this scenario, if historical correlation is used, earlier events may continue to reflect the previously enriched country value (US), even after the correction has been made.
