XSIAM EngineerDemo

By Palo Alto Networks · Question Mode

QuestionQ56

Integration and Automation

How does Cortex XSIAM assist with raw-log ingestion from third-party sources in an existing infrastructure?

  • A Any structured logs coming into it are left completely unchanged, and only metadata is added to the raw data.
  • B For structured logs, like CEF, LEEF, and JSON, it decouples the key-value pairs and saves them in table format.
  • C Any unstructured logs coming into it are left completely unchanged, and metadata is not added to the raw data.
  • D For unstructured logs, it decouples the key-value pairs and saves them in a table format.
Explanation

Cortex XSIAM parses structured formats such as CEF, LEEF, and JSON into fields, producing a dataset with columns based on the parsed schema. This makes the individual key-value data available for querying and analysis. Palo Alto Networks documents support for these formats and automatic parsing for third-party log ingestion.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!