Need help on UDM Enrichment

Hi ​@Ameya, there are two paths you could take here:

1. write a parser extension that no-ops the extraneous fields you’re receiving from the source 
2. disable the applicable enrichment block(s) to prevent said enrichment from occurring (docs here: https://docs.cloud.google.com/chronicle/docs/event-processing/block-enrichment-flows)

Given the massive number of enrichment fields shown there, it’s also possible that the provenance fields specifically are incorrectly stitching together / keying off an identifier, thus merging unrelated entities and leading to the large excess in unhelpful fields? 

Hi ​@MitchellR,

Thanks for the reply!

For the first option, Do I have to rewrite the whole parser logic in the extension or just the part that removes the extraneous fields?

You would only target the fields you’re looking to change/drop. The rest of the parser can stay as-is, and your extension would take precedence on the specific fields you target. The flow would be default parser > extension > resulting data. 

Another way maybe can do from the source, only ingest the selected fileds, but need custom ingestion via cloud storage or via your data pipeline: 

Filter at the Ingestion Source (Microsoft Graph $select) — Best Practice

If ingesting Azure AD context via the Microsoft Graph API / Azure AD Feed:

• Restrict the queried attributes by using the $select OData query parameter in the API feed or collector script.
• Example:

  $select=id,displayName,userPrincipalName,mail,department,jobTitle,manager,accountEnabled,createdDateTime

• Why this is preferred: It prevents large, unnecessary directory extension payloads (500+ key-value pairs) from consuming network bandwidth, ingestion quota, and processing overhead before they even reach Google SecOps.