4.3 Troubleshoot Data Management Issues (e.g., Data Ingestion, Normalization, Parsing) XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A log source is sending multi-line events, but XSIAM is treating each line as a separate event. What is the most likely cause of this parsing issue?

   • AThe log source is using a different timestamp format.
   • BThe XSIAM data model does not support multi-line events.
   • CThe parser is not configured to handle multi-line events.
   • DThe log source is sending events in the wrong order.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization ingests Windows Event Logs into XSIAM. The data is arriving, but the Event ID 4625 (failed logon) events are not populating the standard authentication fields like 'src_user' and 'dst_host'. The raw logs are visible in the raw log view. What is the most likely cause and the appropriate first step?

   • AThe parser is failing to extract the fields from the raw event; check the parser's regex patterns.
   • BThe normalization rules are not mapping the raw fields to the XSIAM data model; review and update the normalization rules for Windows Event 4625.
   • CThe collector is not forwarding the events to the XSIAM broker; restart the collector.
   • DThe log source is not configured with the correct timezone; adjust the timezone settings.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has multiple log sources sending to XSIAM. One log source is not appearing in the Data Ingestion page. The source is configured correctly and the collector is receiving its traffic. What should the administrator check?

   • ACheck the collector's network interface to ensure it is up.
   • BVerify that the log source is enabled in the XSIAM log source configuration.
   • CReview the parser configuration for that log source.
   • DConfirm that the log source's IP address is not blocked by a firewall.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   After adjusting a log source's configuration in XSIAM, what is the best way to verify that the change was successful?

   • AReview the source's syslog configuration file.
   • BCheck the data pipeline monitoring dashboard for incoming events from the source.
   • CRestart the XSIAM collector service.
   • DWait for the next scheduled report.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An XSIAM engineer notices that no new events are appearing in the data ingestion pipeline for a specific log source. Which initial step should the engineer take to begin troubleshooting the ingestion failure?

   • ADisable and re-enable the log source in the XSIAM console to force a refresh.
   • BCheck the XSIAM data lake for any recent normalization failures.
   • CVerify that the log source is configured to send data to the correct collector or ingestion endpoint.
   • DReinstall the XSIAM agent on the log source to reset its configuration.
   Reveal Solution Discussion Select an answer first