An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the…

The correct answer is D. CONST. In Cortex XDR's custom parsing rules, the CONST section is where administrators define reusable constants - including reusable extraction patterns and field definitions - that can be referenced throughout the rule and applied consistently across multiple data sources. RULE is…

Log Management and Data Ingestion

Question

An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the administrator use to define those reusable rules in Cortex XDR?

Options

ARULE
BINGEST
CFILTER
DCONST

How the community answered

(37 responses)

A
5% (2)
C
3% (1)
D
92% (34)

Explanation

In Cortex XDR's custom parsing rules, the CONST section is where administrators define reusable constants - including reusable extraction patterns and field definitions - that can be referenced throughout the rule and applied consistently across multiple data sources. RULE is the primary section where the actual parsing logic executes, but it consumes constants rather than defining reusable ones. INGEST handles how raw data enters the pipeline (data ingestion configuration), not reusable logic. FILTER is used to match or exclude specific log entries before processing, not to define shared definitions.

Memory tip: Think "CONST = consistent reuse" - just like a const variable in programming holds a reusable value you define once and reference many times, the CONST section in XDR parsing rules does the same for log field extraction logic.

Topics

#parsing rules#CONST section#reusable rules#log field extraction

Community Discussion

No community discussion yet for this question.

Full XDR-ENGINEER Practice