3.5 Configure Parsing Rules XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A parsing rule is not extracting fields from a new log format. What is the most likely cause?

   • AThe rule is disabled
   • BThe extraction pattern does not match the structure of the new log format
   • CThe field mappings are incorrect
   • DThe log source is not configured in XDR
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A parsing rule for a network device log fails to match any logs. The log format is 'timestamp=2025-03-01T12:00:00Z src_ip=192.168.1.1 dst_ip=10.0.0.2'. The rule uses the pattern 'timestamp=(?<timestamp>\S+) src_ip=(?<src_ip>\S+) dst_ip=(?<dst_ip>\S+)'. The test with a sample log succeeds, but live logs do not match. What is the most likely cause?

   • AThe live logs are compressed, and the parser cannot read them.
   • BThe live logs use a different timestamp format, such as '2025-03-01 12:00:00' instead of '2025-03-01T12:00:00Z'.
   • CThe live logs contain additional fields before 'timestamp', causing the regex to fail at the start.
   • DThe live logs use uppercase keys like 'SRC_IP' instead of 'src_ip'.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why does rule order matter when multiple parsing rules could match the same log?

   • ARule order only affects performance, not the outcome
   • BAll matching rules are applied sequentially, merging their extracted fields
   • CThe first matching rule in the order is applied, and later rules are not evaluated for that log
   • DThe last matching rule in the order overrides earlier ones
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization ingests logs from multiple sources, including firewalls, endpoints, and cloud services. Each source has a different log format. They want to normalize the 'src_ip' field across all sources so that detection rules can use a single field name. What is the primary purpose of creating parsing rules in this scenario?

   • ATo filter out low-priority logs before they are stored.
   • BTo reduce the storage size of the raw logs.
   • CTo transform raw log data into a consistent, normalized format for analysis.
   • DTo encrypt the log data at rest.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the impact of disabling a parsing rule in XDR?

   • AThe rule is permanently removed and cannot be re-enabled
   • BAll previously parsed logs are deleted
   • CThe rule is no longer applied to incoming logs, so those logs remain unparsed
   • DThe rule's match conditions are automatically updated
   Reveal Solution Discussion Select an answer first