3.5 Configure Parsing Rules XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of a parsing rule in Palo Alto Networks XDR?

   • ATo filter out low-priority logs to reduce storage costs
   • BTo encrypt raw log data before it is stored in the data lake
   • CTo convert raw log data into a standardized format with consistent field names and values
   • DTo generate alerts when suspicious activity is detected in raw logs
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A team has a parsing rule that extracts 'user' and 'action' from a log source. They need to add a new field 'ip' to the extraction. The log format is 'user=jdoe action=login ip=192.168.1.1'. The existing regex is 'user=(?<user>\S+) action=(?<action>\S+)'. What is the best way to update the rule?

   • ADisable the existing rule and create a new one from scratch.
   • BUse a regex that matches the entire line and captures all fields at once.
   • CCreate a new rule for the 'ip' field and place it after the existing rule.
   • DAppend ' ip=(?<ip>\S+)' to the existing regex.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team has a parsing rule that is no longer needed because the log source has been decommissioned. They want to ensure the rule does not process any new logs but want to keep it for reference. What should they do?

   • AMove the rule to the bottom of the rule order.
   • BDisable the rule so it is not evaluated.
   • CDelete the rule to free up resources.
   • DEdit the rule to change its log source to a dummy source.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which step is part of creating a parsing rule in the XDR interface?

   • ASelecting the encryption algorithm for the log data
   • BDefining the extraction logic to capture fields from the raw log
   • CConfiguring an alert notification email
   • DSetting up a scheduled export of parsed logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization has two parsing rules for the same log source. Rule 1 extracts 'user' and 'action' from a key-value format. Rule 2 extracts 'user' and 'ip' from a different format. A log line matches both rules, but the 'user' field is extracted differently by each. The team wants Rule 1 to take precedence. What should they do?

   • ADisable Rule 2 so that only Rule 1 processes the log.
   • BMove Rule 1 above Rule 2 in the rule order.
   • CEdit Rule 2 to remove the 'user' field extraction.
   • DCreate a third rule that combines both extractions.
   Reveal Solution Discussion Select an answer first