CCSE: CrowdStrike Certified SIEM EngineerDemo

By CrowdStrike · Question Mode

QuestionQ39

Parsing and Normalization

What time format does the @timestamp field use when data is parsed with the CrowdStrike Parsing Standard (CPS)?

  • A ISO 8601
  • B Unix Time in microseconds
  • C Human-readable
  • D Unix Time in milliseconds
Explanation

In CrowdStrike CPS, @timestamp is a Unix timestamp. Falcon LogScale requires this field to be formatted as Unix time in milliseconds (UTC), rather than as an ISO 8601 or other human-readable string.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!