3.5 Configure Parsing Rules XDR-ENGINEER Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   When troubleshooting a parsing rule that is not matching any logs, which step should you take first?

   • ADisable all other parsing rules to isolate the issue
   • BIncrease the log retention period
   • CReview the match conditions to ensure they align with the log source and content
   • DDelete the rule and recreate it from scratch
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a parsing rule, what is the role of the extraction pattern?

   • AIt assigns extracted values to normalized XDR fields
   • BIt determines the order in which multiple parsing rules are evaluated
   • CIt defines the regular expression or template used to pull values from the raw log message
   • DIt specifies which log sources the rule should apply to
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A team is creating a parsing rule for a log source that uses a delimiter-separated format, such as '2025-03-01,12:00:00,192.168.1.1,10.0.0.2'. They need to extract the third field as 'src_ip' and the fourth as 'dst_ip'. What is the most efficient way to configure the extraction?

   • AUse the delimiter-based extraction feature and specify the comma as the delimiter and the field positions.
   • BUse a regex pattern that matches the entire line and captures the fields.
   • CUse a regex pattern that only matches the third and fourth fields.
   • DCreate a custom script to preprocess the logs before ingestion.
   Reveal Solution Discussion Select an answer first