3.2 Deploy Data Modeling Rules for Data Normalization XSIAM-ENGINEER Practice Questions (Page 7)

Questions 31–33

1. 31foundation · medium

   How are raw log fields mapped to standardized data model fields in XSIAM?

   • ABy manually editing each raw log entry in the XSIAM interface
   • BBy using machine learning to automatically infer field mappings without any rules
   • CBy using parsing and transformation techniques within data modeling rules
   • DBy creating a separate dataset for every unique raw field name
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team is building a data modeling rule for DNS logs. The raw log contains a field 'query' that includes the domain name and sometimes a trailing dot (e.g., 'example.com.'). They need to normalize this to 'dns_query' without the trailing dot. Which technique should they use?

   • AUse a regex replacement to remove the trailing dot if present.
   • BUse an EDL to map the domain to a standardized name.
   • CMap the raw field directly to 'dns_query'.
   • DUse a lookup table to convert the domain to an IP address.
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   A team is ingesting proxy logs where the destination port is embedded in a string like 'dest_port=8080'. They need to map this to the standard field 'destination_port' as an integer. What is the correct approach in a data modeling rule?

   • ACreate a new dataset specifically for this log source and store the raw field as-is.
   • BUse a regex extraction to capture the digits after 'dest_port=' and then cast the result to an integer.
   • CUse a lookup table to map the raw string to a port number.
   • DMap the raw field directly to 'destination_port' without any transformation.
   Reveal Solution Discussion Select an answer first