XDR-ENGINEER: Palo Alto Networks Certified XDR EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ8

Ingestion and Automation

A new parsing rule has been created. During testing and verification, all logs from which field data should be parsed are missing, while all other logs from this data source appear as expected.

What could be causing this behavior?

  • A The XDR Collector is dropping the logs.
  • B The filter stage is dropping the logs.
  • C The Broker VM is offline.
  • D The parsing rule corrupted the database.
Explanation

A filter stage can exclude log records that do not meet its criteria. When the affected records are filtered out—especially where the applicable no-match behavior is set to drop—they are not passed through for ingestion, while other logs from the same data source can still appear normally.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!