When data is ingested into Google SecOps, when is the raw data discarded?
- Raw data is never retained in Google SecOps, only data successfully parsed into the UDM schema.
- If the data is ingested, the raw data is always retained even if parsing fails.
- If parsing fails then the raw data will also be discarded.
- If the parser for the data type indicates that the log should be dropped, it will be discarded.