4.1 Identify and Describe Cortex Data Models (XDMs) XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst needs to investigate a suspicious process execution. The XDM-normalized data shows the process name and command line, but the analyst needs to see the exact raw log entry to verify a specific field that is not mapped to XDM. What should the analyst do?

   • AModify the XDM schema to include the missing field.
   • BQuery the raw data for the specific log entry to see the original fields.
   • CRe-ingest the log with a different parser to capture the field.
   • DUse the XDM data only, as it contains all fields from the raw log.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In an XDM schema, what does a field like 'actor.process.name' represent?

   • AA metadata tag that describes the process's role in the event
   • BA flat field that stores the full process name as a single string
   • CAn array of process names associated with the actor
   • DA nested object where 'actor' contains 'process', which contains 'name'
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company ingests logs from multiple sources, but some sources have overlapping field names that map to different XDM fields. For example, 'user' in one source maps to 'xdm.source.user.username', while in another source it maps to 'xdm.target.user.username'. An analyst wants to query for events where the source user is 'admin'. What is the best approach?

   • AQuery the raw data for each source separately and combine the results.
   • BModify the parsers to map 'user' to the same XDM field in all sources.
   • CUse a wildcard in the query to match any field containing 'user'.
   • DUse the XDM field 'xdm.source.user.username' in the query, as it is normalized across sources.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company ingests firewall logs from a third-party vendor. The vendor's log field 'src_ip' needs to be mapped to the XDM field 'source_ip'. Where does this mapping occur in XSIAM?

   • AAt query time, when the analyst writes an XQL query that explicitly maps each field.
   • BDuring report generation, when the output is formatted for display.
   • CDuring the data ingestion and parsing stage, using a parser that maps raw fields to XDM fields.
   • DIn the XSIAM storage layer, where raw data is automatically converted to XDM without any configuration.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst needs to compare the number of authentication failures detected by XDM-normalized data versus the raw logs to verify that the XDM mapping is correct. What is the most appropriate approach?

   • ARun two queries: one on XDM data and one on raw data, then compare the counts.
   • BUse the XDM schema documentation to verify the mapping without querying.
   • CRun a single query on XDM data and assume it matches raw data.
   • DRun a single query on raw data and ignore XDM data.
   Reveal Solution Discussion Select an answer first