XDR-ENGINEER: Palo Alto Networks Certified XDR EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ7

Ingestion and Automation

Which method drops unwanted logs and reduces the volume of data being ingested?

  • A [INGEST:vendor= “vendor”, product= “product”, target_dataset= “vendor_product_raw”, no_hit=drop] filter _raw_log not contains “undesired logs”;
  • B [COLLECT:vendor= “vendor”, product= “product”, target_dataset=*, no_hit=drop] drop _raw_log contains “undesired logs”;
  • C [INGEST:vendor= “vendor”, product= “product”, target_brokers= “vendor_product_raw”, no_hit=keep] filter _raw_log not contains “undesired logs”;
  • D [COLLECT:vendor= “vendor”, product= “product”, target_brokers=*, no_hit=drop] drop _raw_log contains “undesired logs”;
Explanation

Cortex XDR uses COLLECT rules on Broker VMs for data reduction before logs are sent to the Cortex XDR server. A COLLECT section requires target_brokers; target_brokers=* applies the rule to all Broker VM applet data. The drop stage discards every log entry that meets its condition, so logs whose _raw_log contains the specified unwanted text are excluded before ingestion.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!