GSEC · Question #271
What is log, pre-processing?
The correct answer is B. Converting logs from one format to another. Log pre-processing is the normalization step that converts raw logs from diverse source formats into a common, standardized format suitable for analysis and correlation.
Question
What is log, pre-processing?
Options
- ARemoving known bad log event entries
- BConverting logs from one format to another
- CMoving log entries of unknown status to an analyst's queue
- DTransferring logs to short-term storage
How the community answered
(23 responses)- A4% (1)
- B78% (18)
- C4% (1)
- D13% (3)
Why each option
Log pre-processing is the normalization step that converts raw logs from diverse source formats into a common, standardized format suitable for analysis and correlation.
Removing known bad log entries describes log filtering or suppression, which is a separate step that occurs after pre-processing, not during it.
Different systems (firewalls, servers, applications) emit logs in different formats such as syslog, CEF, JSON, or proprietary text. Pre-processing parses and converts these varied formats into a unified schema so that a SIEM or log analysis platform can correlate and query them consistently. This normalization step occurs before any analysis, filtering, or storage decisions are made.
Moving entries of unknown status to an analyst queue is a triage or escalation workflow, which happens during the analysis phase rather than during pre-processing.
Transferring logs to short-term storage is a log management and retention task, not a pre-processing or normalization activity.
Concept tested: Log normalization and pre-processing in SIEM pipelines
Source: https://csrc.nist.gov/publications/detail/sp/800-92/final
Topics
Community Discussion
No community discussion yet for this question.