QuestionQ26Verified/Content OptimizationCopy linkReport a problemAsk AstroTutorSave questionWhat is a principal characteristic of a parsing rule in Cortex XSIAM?AIt uses regular expressions exclusively for data modifications, discards unmatched logs by default, and only retains fields with non-null values.BIt is bound to all vendors and products, performs data parsing once per log, and does not allow grouping.CIt is bound to a specific vendor and product, performs data parsing once per log, and does not allow grouping.DIt is bound to a specific vendor and product which allow grouping with a no-match policy, and retains all fields.Show AnswerAnswerExplanationCortex parsing rules are associated with a specific vendor and product, may be grouped under a no-match policy that determines how unmatched logs are handled, and retain all ingested fields, including fields with null values. Palo Alto Networks: What are Parsing Rules?Learn moreWhat are Parsing Rules?Show comments2Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion