XSIAM EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ26

Content Optimization

What is a principal characteristic of a parsing rule in Cortex XSIAM?

  • A It uses regular expressions exclusively for data modifications, discards unmatched logs by default, and only retains fields with non-null values.
  • B It is bound to all vendors and products, performs data parsing once per log, and does not allow grouping.
  • C It is bound to a specific vendor and product, performs data parsing once per log, and does not allow grouping.
  • D It is bound to a specific vendor and product which allow grouping with a no-match policy, and retains all fields.
Explanation

Cortex parsing rules are associated with a specific vendor and product, may be grouped under a no-match policy that determines how unmatched logs are handled, and retain all ingested fields, including fields with null values. Palo Alto Networks: What are Parsing Rules?

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!