XDR-ENGINEER: Palo Alto Networks Certified XDR EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ6

Ingestion and Automation

An administrator wants to use reusable rules in custom parsing rules to ensure consistent log-field extraction across multiple data sources.

Which parsing-rule section should the administrator use to define these reusable rules in Cortex XDR?

  • A RULE
  • B INGEST
  • C FILTER
  • D CONST
Explanation

The RULE section defines named reusable XQL logic that other parsing-rule sections can invoke with call, enabling common log-field extraction logic to be used without duplicating it. The CONST section is limited to reusable string and integer values.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!