CCSE: CrowdStrike Certified SIEM EngineerDemo

By CrowdStrike · Question Mode

QuestionQ38

Parsing and Normalization

While reviewing logs, you discover that incoming firewall-log content appears as a single large block of text in the @rawstring field. The other anticipated structured fields are empty.

What is causing this issue?

  • A The parser was incorrect
  • B The ingestion token is invalid
  • C The sink was overloaded
  • D The timestamp format is incorrect
Explanation

Parsers transform raw firewall logs into structured fields. When the incoming format does not match the applicable parser or its extraction rules, the log remains as raw text and the structured fields are not populated.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!