4.2 Use XDMs to Analyze Security Events XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common XDM field type used for storing the severity of an event?

   • AInteger
   • BString
   • CEnum
   • DBoolean
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A raw event from an EDR product includes the field 'process_name'. Which XDM field is the standard mapping for this field?

   • Axdm.event.process_name
   • Bxdm.process.name
   • Cxdm.file.name
   • Dxdm.actor.process.name
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When a raw security event from a firewall contains the field 'src_ip', which XDM field would this typically map to?

   • Axdm.observer.ip
   • Bxdm.target.ip
   • Cxdm.source.ip
   • Dxdm.destination.ip
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a suspicious PowerShell execution on a Windows endpoint. The raw event log contains a field named 'CommandLine' that holds the full command string. The analyst wants to write an XQL query that searches for the string 'Invoke-Mimikatz' across all endpoints using the standardized XDM field. Which XDM field should the query reference?

   • Axdm.event.command_line
   • Bxdm.target.process.command_line
   • Cxdm.actor.process.command_line
   • Dxdm.process.command_line
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of Extended Data Models (XDMs) in XSIAM?

   • ATo automatically generate detection rules without analyst input
   • BTo provide a standardized schema for security data from diverse sources
   • CTo encrypt all security data at rest and in transit
   • DTo replace the underlying raw log storage with a proprietary format
   Reveal Solution Discussion Select an answer first