CCSE: CrowdStrike Certified SIEM Engineer

Question

You are a Next-Gen SIEM Engineer responsible for creating parsers. An internal requirement is to retain both the Vendor and ECS field names in the Fields panel in Advanced Event Search.

What is the correct way to add the ECS field while preserving the Vendor field in a parser?

Explanation

The := assignment operator creates a new ECS field from the Vendor field’s value while leaving the original Vendor field intact. LogScale documents := as shorthand for field assignment through eval and for assigning a function result to a named output field, so both field names remain available.

Learn more

Adding Fields to Events | LogScale Documentation

CCSE: CrowdStrike Certified SIEM Engineer

AstroTutor

Notes

Readiness

QuestionQ22

Community Discussion