3.1 Deploy Parsing Rules for Unique Data Formats XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A parsing rule for a key-value log format is producing an error: 'Field src_ip has incompatible type: expected IP, got string'. The raw value is '192.168.1.1'. What is the most likely cause?

   • AThe transformation logic is missing a step to convert the string to an IP address type.
   • BThe sample data is invalid; '192.168.1.1' is not a valid IP address.
   • CThe parser type is incorrectly set to key-value; it should be regex to handle IP addresses.
   • DThe field mapping is wrong; 'src_ip' should be mapped to a different raw field.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a parsing rule, what is the purpose of field mapping?

   • ATo define the regular expression pattern used to match the log
   • BTo assign extracted values to normalized fields in the data model
   • CTo transform values, such as converting strings to integers
   • DTo specify which data source the rule applies to
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A parsing rule for a custom CSV-like format is failing because the 'timestamp' field is being parsed as a string instead of a date. The raw value is '2024-03-15T10:30:00Z'. What should be adjusted in the parsing rule?

   • AAdd a transformation that converts the string to a timestamp using the appropriate date format specifier.
   • BRemove the timestamp field from the mapping so it is not parsed at all.
   • CChange the parser type from CSV to regex so the timestamp is recognized automatically.
   • DModify the field mapping to rename 'timestamp' to 'time' to avoid the type conflict.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is ingesting logs from a proprietary database that outputs records in a nested JSON structure. The relevant fields are buried three levels deep (e.g., 'data.event.details.src_ip'). The parsing rule must extract 'src_ip' into a top-level field. What is the most efficient approach?

   • AUse a key-value parser with the delimiter set to '.' to split the nested keys.
   • BUse a JSONPath expression in the field mapping to directly reference 'data.event.details.src_ip'.
   • CFlatten the JSON into a single level using a transformation, then map the flattened field.
   • DWrite a regex pattern that matches the entire JSON and captures 'src_ip' from the raw text.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization ingests JSON logs from a cloud application where the 'user' field is sometimes a string (e.g., 'alice') and sometimes an object (e.g., {'id': 123, 'name': 'alice'}). The parsing rule must extract the user's name in both cases. What is the most appropriate approach?

   • ASet the parser to ignore events where 'user' is an object and only process string values.
   • BDefine two separate parsing rules and use a filter to route events based on the presence of the 'name' sub-field.
   • CConfigure the parser to always treat the 'user' field as a string and extract the value after the colon.
   • DUse a transformation function that checks the data type of the 'user' field and extracts 'name' if it is an object, otherwise uses the string value directly.
   Reveal Solution Discussion Select an answer first