CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ18

VerifiedParsing and Normalization

You need a consistent view of events from different data sources.

Which ECS field type should be normalized?

Explanation

ECS core fields represent the most commonly applicable event data across use cases. Populating and normalizing them enables searches, dashboards, alerts, and other analysis content to work consistently with relevant events from any data source.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!