CCSEPreview

Which two tags are compliant with the CrowdStrike Parsing Standard (CPS)?

You are a Next-Gen SIEM Engineer responsible for parser creation. An internal requirement is to maintain both the Vendor and ECS field names within the Fields panel in Advanced Event Search.
What is the correct method for adding the ECS field while maintaining the Vendor field in a parser?

What is the time format for the @timestamp field when data is parsed using the CrowdStrike Parsing Standard (CPS)?

What is the correct mode to enroll LogCollector into Fleet Management with configuration of the log sources stored and managed centrally in Next-Gen SIEM?

What are the four required CPS-compliant Event parser tags?

Which three System alerts are enabled by default in Next-Gen SIEM for third-party connectors?

Which default role will maintain least privilege and allow for creation and management of parsers?

A Falcon Log Collector has been configured with 4 sinks of type memory, each having a queue size of 2GB.
What is the minimum memory requirement produced by this configuration?

What should you do with a field that is not CPS-compliant when adding it to a parser?

Review the log sample below:

What type of parser should be used to extract fields and values from this log?

What is the maximum number of active correlation rules in a CID?

Review the log event below:

{"ts": "2018/11/01 14:31:10", "server": "webOl", "message": "Out of memory"}

Which parsing function is correct to add a missing timezone field?

What is the first consideration when determining the necessary sizing requirements for log collector clients in a Next-Gen SIEM deployment?

What is the purpose of labels in Fleet Management?

What dashboard presents a view of third-party data ingestion over the past 30 days?

You want a Next-Gen SIEM dashboard to update automatically when new data is available.
Which action would you take?

You are creating a dashboard in Next-Gen SIEM and want to change the visualization used by a widget.
What must be selected to make this change?

Which are valid parse functions in CQL?

You are configuring third-party data for ingestion. Once a connection is established, you see the HTTP response code 413 as received by your data shipper.
What does this response code indicate?

You find a Falcon Log Collector instance on a Linux system that is not connected to Fleet Management.
What command would you use to enroll the Falcon Log Collector?

Which statement is accurate about how data ingest is measured and represented in Next-Gen SIEM?

You need to ingest a data source into Next-Gen SIEM. There is a prebuilt Pull connector.
What is required to configure the connector?

Which sequence correctly describes the process for duplicating a workflow in Fusion SOAR?