CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ3

VerifiedParsing and Normalization

You observe that, during log collection, the format of incoming logs abruptly changes from JSON to key-value pairs.

What action would you take to parse the data correctly?

Explanation

JSON and key-value records require different parsing rules. A multi-source configuration supports assigning an appropriate parser to each source or format, so both types of incoming logs can be interpreted correctly.

Community Discussion

No comments yet. Be the first to start the discussion!