A company is onboarding its Palo Alto Networks firewall logs to XSIAM. The firewall sends syslog to a collector, and the logs are visible in the raw log viewer. However, when the security team runs a correlation rule that references the field `source_ip`, the rule never fires, even though the raw logs clearly contain source IP addresses. What is the most likely cause and the appropriate action?

The firewall must be configured to send logs via API instead of syslog for XSIAM to parse them.

The firewall is sending logs in a format that XSIAM has not parsed into the normalized data model; verify the parser and field mapping.

The syslog collector is using UDP, which drops packets under load; switch to TCP.

The correlation rule is using the wrong time range; adjust the rule's lookback window.

A company is onboarding Active Directory logs to XSIAM. The integration is configured to use a collector that reads Windows Event Logs from domain controllers. The collector is running, but no logs are appearing in XSIAM. What is the most likely cause?

The collector does not have permission to read the Windows Event Logs on the domain controllers.

The collector is using the wrong port to send logs to XSIAM.

The XSIAM data model does not support Active Directory logs.

The domain controllers are not generating any authentication logs.

Which benefit does data normalization provide for security analysts?

Consistent field names across different sources

Reduced network bandwidth usage

Palo Alto NetworksCertified XSIAM Engineer

Domain 2Objective 1

2.1 Onboard Data Sources (e.g., Endpoint, Network, Cloud, Identity) XSIAM-ENGINEER Practice Questions (Page 2)

Part of the Integration and Automation domain, which accounts for 30% of the XSIAM-ENGINEER exam.

21questions here

5free pages

7concepts

30%of the exam

Questions 6–10

6application · medium
A company is onboarding its Palo Alto Networks firewall logs to XSIAM. The firewall sends syslog to a collector, and the logs are visible in the raw log viewer. However, when the security team runs a correlation rule that references the field `source_ip`, the rule never fires, even though the raw logs clearly contain source IP addresses. What is the most likely cause and the appropriate action?
Select an answer first
7application · medium
A company is onboarding Active Directory logs to XSIAM. The integration is configured to use a collector that reads Windows Event Logs from domain controllers. The collector is running, but no logs are appearing in XSIAM. What is the most likely cause?
Select an answer first
8foundation · easy
Which identity provider is commonly integrated with XSIAM to ingest authentication logs?
Select an answer first
9foundation · easy
Which benefit does data normalization provide for security analysts?
Select an answer first
10foundation · easy
Besides syslog, which method can be used to onboard network source logs from devices that support it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSIAM-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSIAM-ENGINEER” is a trademark of its owner, used for identification only.

2.1 Onboard Data Sources (e.g., Endpoint, Network, Cloud, Identity) XSIAM-ENGINEER Practice Questions (Page 2)

Questions 6–10

A company is onboarding Active Directory logs to XSIAM. The integration is configured to use a collector that reads Windows Event Logs from domain controllers. The collector is running, but no logs are appearing in XSIAM. What is the most likely cause?

Which identity provider is commonly integrated with XSIAM to ingest authentication logs?

Which benefit does data normalization provide for security analysts?

Besides syslog, which method can be used to onboard network source logs from devices that support it?

Keep studying — Integration and Automation