Palo_Alto_Networks
PCSAE · Question #8
An engineer's organization system is registered in the following manner: <SiteName-SystemID-Username>. The engineer created a new indicator type for detecting systems using regex. The engineer would…
The correct answer is C. Create a new indicator type of the internal username and set a formatting script to extract only the. See the full explanation below for the reasoning.
Question
An engineer's organization system is registered in the following manner:
<SiteName-SystemID-Username>. The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate `User' indicator automatically once a system is found. What is the most efficient way for the engineer to achieve this?
Options
- ACreate a custom indicator field named `username' and link it to the internal system indicator
- BChange the reputation command for the internal system indicator type
- CCreate a new indicator type of the internal username and set a formatting script to extract only the
- DCreate a new indicator type of the internal username and have the regex included on any string
How the community answered
(54 responses)- A17% (9)
- B7% (4)
- C74% (40)
- D2% (1)
Community Discussion
No community discussion yet for this question.