An administrator needs to extract a property from an intrusion detection system (IDS) log. Using a regular expression, the administrator wants to extract a specific part of the log showing the…

Question

Options

• ACustom event property
• BCustom flow property
• CCustom asset property
• DNormalized event property

• A
  2% (1)
• B
  13% (6)
• C
  7% (3)
• D
  78% (35)

Explanation

Normalized event properties are the correct choice because they are specifically designed to extract and parse data from event logs (like IDS logs) using regular expressions - mapping raw log fields into a structured, queryable format within SIEM platforms like IBM QRadar. A "policy ID" from an IDS log is event data that needs to be normalized into the system's event schema, making it searchable and reportable.

Why the distractors are wrong:

• A (Custom event property) - Custom event properties also use regex against event payloads, but they are for additional fields not covered by existing normalization; the distinction here is that the question asks about extracting a standard IDS field (policy ID), which falls under normalization. (Note: In some QRadar contexts, A and D overlap - if your exam source treats them as distinct, "normalized" refers to the DSM-level parsing layer.)
• B (Custom flow property) - Flow properties apply to network flow data (NetFlow, sFlow), not log/event data from an IDS.
• C (Custom asset property) - Asset properties describe endpoints/devices (IP, hostname, OS), not log entries or security events.

Memory tip: Think "N for Normalize = N for Network security events (IDS/IPS logs)." Flows = traffic, Assets = devices, Events = logs - and normalizing a log field means making it conform to a standard schema using regex.

No community discussion yet for this question.