XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

By Palo Alto Networks · Question Mode

QuestionQ16

VerifiedMaintenance and Troubleshooting

Cortex XSIAM has received no logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW." An engineer wants to create an alert for this condition.

Correlation rule settings include:

  • Time Schedule: Every 30 minutes
  • Query Timeframe: 30 minutes
  • Action: Generate alert
  • Alert Name: No logs received from MainFW in the past 30 minutes

Which query should be used in the correlation rule?

Explanation

The metrics_view preset is intended for investigating collection disruptions because it simulates zero-value ingestion-metric entries when no logs are collected. total_event_count is the number of logs collected during an aggregation period, so summing it for the PANW NGFW reporting device MainFW and filtering for a sum of zero detects that no logs arrived in the configured 30-minute timeframe.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!