XSIAM EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ42

Content Optimization

A security engineer observes that ingestion has increased significantly during the past week. After investigating the anomaly, it is determined that an in-house custom application caused the increase. The custom application sends syslog to the Broker VM Syslog Collector applet. The engineer consults the SOC analyst, who determines that 90% of logs from the custom application are unused.

What can the engineer configure to reduce ingestion?

  • A Parsing rule to drop the unnecessary data at the Broker VM
  • B Data model rule to drop the unnecessary data
  • C Correlation rule on the Cortex XSIAM server to drop the unnecessary data
  • D Data model rule to map the useful data
Explanation

A Parsing Rule with a COLLECT section can filter and drop unnecessary syslog events on the Broker VM before they are forwarded to the Cortex XSIAM server. This directly reduces transmitted and ingested data, unlike data model or correlation rules, which operate after data reaches the server.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!