4.3 Troubleshoot Data Management Issues (e.g., Data Ingestion, Normalization, Parsing) XSIAM-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is troubleshooting why logs from a specific server are not being ingested. The server is sending logs to the collector via TCP, and the collector is listening on the correct port. The analyst checks the Data Ingestion page and sees no data from that server. What should the analyst do next?

   • ACheck the server's local log buffer to see if logs are being generated.
   • BVerify that the server's syslog daemon is configured to send to the correct IP and port.
   • CReview the normalization rules for the server's OS.
   • DRestart the collector to re-establish the TCP connection.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization uses a third-party SIEM to forward logs to XSIAM. The logs were working, but after a network change, they stopped. The SIEM shows successful forwarding, and the collector is receiving packets. However, no new data appears in XSIAM. What should the analyst investigate?

   • AVerify that the SIEM is sending logs in a format that XSIAM can parse.
   • BReview the SIEM's forwarding logs to confirm the exact destination IP and port.
   • CCheck if the SIEM's log source is still mapped to the correct collector in XSIAM.
   • DRestart the collector to re-establish the connection with the SIEM.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A firewall is configured to forward logs to XSIAM, but the logs are not appearing in the data pipeline. Which of the following is a common source-side issue that could cause this?

   • AThe XSIAM data model does not include a schema for firewall logs.
   • BThe firewall's log format is not in CEF format.
   • CThe XSIAM collector is configured to use a different port than the firewall's default.
   • DThe firewall's syslog server address is set to an unreachable IP address.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A network team has configured a new firewall to send logs to XSIAM. The logs are not appearing. The firewall's syslog settings show the correct collector IP and port, and the collector is listening. What should the team verify next?

   • AConfirm that the firewall's syslog source is enabled in the XSIAM log source configuration.
   • BVerify that the firewall's syslog format matches the parser in XSIAM.
   • CRestart the collector service to ensure it is ready to receive logs.
   • DCheck if the firewall is generating logs at all by reviewing its local log buffer.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC team is monitoring the data pipeline and notices that a specific log source has a high rate of parsing errors. The errors are intermittent and occur only during peak hours. The team needs to determine if the issue is with the log source or the parser. What should they do?

   • AIncrease the collector's buffer size to handle the peak load.
   • BDisable the log source and re-enable it to reset the connection.
   • CRestart the collector to clear any temporary issues.
   • DCompare the parsing error logs with the raw logs from the source to identify patterns.
   Reveal Solution Discussion Select an answer first