4.3 Troubleshoot Data Management Issues (e.g., Data Ingestion, Normalization, Parsing) XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When validating a log source configuration in XSIAM, which of the following should be checked to ensure data is sent and received correctly?

   • AThe source's IP address and port are correct and reachable.
   • BThe source's time zone is set to UTC.
   • CThe source's log format is in XML.
   • DThe source's hostname is resolvable via DNS.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is ingesting proxy logs from a custom format. The logs are being parsed correctly, but the 'user' field is not being normalized to the standard 'src_user' field. The raw log shows the user in the 'user' field. What is the most likely cause?

   • AThe parser is not extracting the 'user' field from the raw log.
   • BThe log source is not configured with the correct vendor type.
   • CThe normalization rule for the proxy log source does not map the 'user' field to 'src_user'.
   • DThe collector is dropping the 'user' field during transmission.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a log source that sends logs in a custom format. The logs are being received, but the 'timestamp' field is not being normalized correctly, causing events to appear with incorrect times. The raw log shows the timestamp in a non-standard format. What is the best approach to resolve this?

   • AChange the log source's configuration to send timestamps in a standard format.
   • BRestart the collector to reset the timestamp processing.
   • CUse a custom dashboard to display the raw timestamp and ignore the normalized field.
   • DUpdate the parser to extract the timestamp in the correct format and then adjust the normalization rule to map it to the standard 'event_time' field.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization is ingesting logs from a custom application. The logs are being parsed, but some fields are not being normalized correctly. The team has identified that the parser is extracting the fields, but the normalization rules are not mapping them to the standard fields. The team needs to fix this quickly without affecting other log sources. What is the best approach?

   • AModify the global normalization rules to include the missing mappings.
   • BUse a custom parser to bypass the standard normalization process.
   • CCreate a new normalization rule specific to this log source and test it in a non-production environment.
   • DDisable the log source and re-enable it to reset the normalization.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst notices that some logs from a network device are being dropped during parsing. The raw logs are visible in the collector, but they do not appear in XSIAM. What is the best way to identify the parsing errors?

   • AUse the Data Ingestion page to view parsing error metrics and drill down into the specific logs.
   • BReview the normalization rules to see if the device's vendor is supported.
   • CRestart the collector to clear any temporary parsing issues.
   • DCheck the collector's syslog configuration to ensure it is forwarding all logs.
   Reveal Solution Discussion Select an answer first