CCSE: CrowdStrike Certified SIEM EngineerDemo

Question

Review the following log event:

\{"ts": "2018/11/01 14:31:10", "server": "webOl", "message": "Out of memory"\}

Which parsing function should be used to add a missing timezone field?

A parseJson() | parseTimestamp("dd/MMM/yyyy:HH:mm:ss Z", timezone="Europe/Paris", field=ts)
B kvParse() | findTimestamp(field=ts, timezone="Europe/London")
C kvParse() | findTimestamp(timezone="America/New_York")
D parseJson() | parseTimestamp("yyyy/MM/dd HH:mm:ss", timezone="Europe/Paris", field=ts)

Explanation

A JSON log event must be parsed with parseJson(). The ts value uses the format yyyy/MM/dd HH:mm:ss, and parseTimestamp must target the ts field while specifying the missing Europe/Paris timezone.

CCSE: CrowdStrike Certified SIEM EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ16

Community Discussion