CCSE: CrowdStrike Certified SIEM EngineerDemo

By CrowdStrike · Question Mode

QuestionQ36

Parsing and Normalization

What should be done with a field that is not CPS-compliant when it is added to a parser?

  • A Remove the field from the parser output
  • B Leave the field unchanged
  • C Convert the field to ECS format
  • D Prefix the field with Vendor
Explanation

CPS-compliant parsers preserve fields that do not exist in ECS by prefixing their names with Vendor., which keeps vendor-specific fields distinct while reserving the root namespace for ECS fields.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!