4.2 Use XDMs to Analyze Security Events XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is investigating a series of events that may indicate a compromised user account. The analyst has identified a set of events where the user 'jsmith' logged in from an unusual IP address. The analyst now wants to find all other events where 'jsmith' was the target of an action (e.g., a file was accessed by another user). Which XDM field should be used to find these events?

   • Axdm.actor.user.username
   • Bxdm.target.user.username
   • Cxdm.observer.user.username
   • Dxdm.source.user.username
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security engineer is configuring a new data source in XSIAM. The raw logs contain a field named 'User' that holds the username of the account that performed an action. The engineer needs to ensure this field is mapped to the correct XDM field so that queries for user activity work correctly. Which XDM field should the 'User' field be mapped to?

   • Axdm.target.user.username
   • Bxdm.actor.user.username
   • Cxdm.observer.user.username
   • Dxdm.source.user.username
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) analyst is new to XSIAM and is reviewing a dataset that contains raw logs from various security tools. The analyst notices that the data is already available in a structured format with fields like 'xdm.event.type' and 'xdm.actor.process.name'. What is the primary benefit of this structured format for the analyst's daily work?

   • AIt guarantees that all events from different sources will have identical field values.
   • BIt eliminates the need for any data normalization or parsing during ingestion.
   • CIt ensures that all security events are automatically classified as either malicious or benign.
   • DIt allows the analyst to write queries without needing to know the specific field names used by each individual data source.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is writing a query to find all events where a file was deleted. The analyst recalls that the XDM model has a field for the action performed on a file. Which XDM field should be used to filter for the 'delete' action?

   • Axdm.event.action
   • Bxdm.target.file.action
   • Cxdm.observer.file.action
   • Dxdm.source.file.action
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   To retrieve the source IP address from an XDM event in an XQL query, which field reference is correct?

   • Axdm.src_ip
   • Bxdm.source.address
   • Cxdm.source.ip
   • Dsource.ip
   Reveal Solution Discussion Select an answer first