CCSE: CrowdStrike Certified SIEM EngineerDemo

By CrowdStrike · Question Mode

QuestionQ3

Parsing and Normalization

You observe that, during log collection, the format of incoming logs abruptly changes from JSON to key-value pairs.

What action would you take to parse the data correctly?

  • A Use a multi-source configuration with different parsers per source
  • B Switch to fleet mode and monitor the logs
  • C Restart the log collector in debug mode
  • D Disable parsing entirely
Explanation

JSON and key-value records require different parsing rules. A multi-source configuration supports assigning an appropriate parser to each source or format, so both types of incoming logs can be interpreted correctly.

Community Discussion

No comments yet. Be the first to start the discussion!