CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ59

VerifiedCorrelation Rules and Falcon Fusion SOAR

You are creating a correlation rule in Next-Gen SIEM to trigger alerts according to when the event occurred, regardless of when it was ingested.

Which event timestamp should you choose?

Explanation

@timestamp represents the time the original event occurred in the producing system. It supports event-time correlation independently of any delay before ingestion; @ingesttimestamp represents the time the event was stored by LogScale.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!