3.1 Deploy Parsing Rules for Unique Data Formats XSIAM-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization receives logs where the 'severity' field is encoded as an integer (1-5), but the SIEM expects a string ('low', 'medium', 'high', 'critical'). The parsing rule must convert the integer to the corresponding string. What should be configured?

   • AChange the parser type to automatically infer the string representation from the integer.
   • BSet the field's data type to integer in the mapping so it matches the raw value.
   • CAdd a transformation that uses a lookup table or conditional logic to map the integer to the string value.
   • DModify the field mapping to rename 'severity' to 'severity_level' to avoid the type conflict.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which parsing rule component would you use to convert a string field like `"123"` into an integer field for analysis?

   • ATransformation logic
   • BField mapping
   • CRegex pattern
   • DParser type
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A parsing rule for a custom log format is failing intermittently. The rule uses a regex with a greedy quantifier. The team suspects the greedy quantifier is causing the match to consume too much of the string, leading to incorrect field extraction. What is the most appropriate way to diagnose and fix the issue?

   • AIncrease the regex timeout to allow the greedy quantifier more time to complete the match.
   • BTest the regex against a variety of sample events, including edge cases, and change the greedy quantifier to a lazy one if it is consuming too much.
   • CRemove the transformation logic to simplify the rule and reduce the chance of errors.
   • DReplace the regex parser with a key-value parser to avoid quantifier issues entirely.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Given the log line: `2025-03-01 12:34:56,user123,login,success`, which parsing rule correctly extracts the timestamp and username as separate fields?

   • AUse a comma delimiter and map the first field to timestamp and the second to username
   • BUse a regex pattern `(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}),(\w+),.*` and map group 1 to timestamp and group 2 to username
   • CUse a space delimiter and map the first field to timestamp and the second to username
   • DUse a key-value parser with `=` as the delimiter
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations center (SOC) receives logs from a legacy network appliance that uses a pipe-delimited format with a variable number of fields per event. Some events include an optional 'src_port' field, while others omit it. The team needs to parse these logs into XSIAM so that the 'src_port' field is populated when present and left empty when absent. What should the parsing rule do?

   • AUse a regex pattern with a non-capturing group for the optional 'src_port' segment, and map the capture group to the 'src_port' field.
   • BConfigure the parser to split on the pipe delimiter and map the fifth field to 'src_port' for all events.
   • CUse a fixed-position parser that always extracts the 'src_port' field from the same character offset in every event.
   • DCreate two separate parsing rules, one for events with 'src_port' and one for events without it, and apply them based on the event's source IP.
   Reveal Solution Discussion Select an answer first