3.2 Deploy Data Modeling Rules for Data Normalization XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations team ingests firewall logs from multiple vendors. Each vendor uses different field names and formats for the source IP address (e.g., 'src', 'source_ip', 'SourceAddress'). The team wants to run a single correlation rule that checks for connections from a specific IP across all vendors. What should they do to enable this?

   • AIngest all logs into a single dataset without transformation and rely on the correlation rule to parse the fields.
   • BCreate a data modeling rule that maps each vendor's source IP field to the standard XSIAM field for source IP.
   • CModify the correlation rule to include an OR condition for each vendor's field name.
   • DCreate a separate correlation rule for each vendor and merge the results manually.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A log source provides a field 'event_data' that contains a JSON string with multiple nested fields. The team needs to map the nested field 'user.id' to the standard field 'user_id'. What is the correct approach?

   • ACreate a new dataset to store the JSON data as-is.
   • BUse a JSON parsing function to extract the 'user.id' field and map it to 'user_id'.
   • CUse a regex to match the 'user.id' pattern in the string.
   • DMap the entire 'event_data' field to 'user_id'.
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   Why is data normalization important for security analytics in XSIAM?

   • AIt ensures that all raw logs are stored in their original format for compliance
   • BIt allows analysts to query and correlate data from different sources using common field names
   • CIt automatically blocks malicious traffic based on normalized fields
   • DIt eliminates the need for any parsing or extraction of raw logs
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   Which practice is recommended for designing maintainable data modeling rules?

   • ADuplicate rules for each log source to avoid dependencies
   • BUse clear and descriptive names for fields and rules
   • CCombine all parsing logic into a single complex regex
   • DAvoid using comments in rules to keep them concise
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A data modeling rule is failing to extract a field from a log line that contains multiple delimiters. The log format is: 'user=jsmith;ip=192.168.1.1;port=8080'. The rule uses a regex that expects a comma delimiter. What is the most efficient way to fix this?

   • AUpdate the regex pattern to use the semicolon delimiter.
   • BIgnore the extraction and use the raw field.
   • CCreate a new data modeling rule for this log source.
   • DChange the log source to output a comma delimiter.
   Reveal Solution Discussion Select an answer first