Which query will hunt for only incoming traffic from 99.99.99.99 when all log sources have been mapped to XDM?

The correct answer is A. datamodel dataset = * | fields fieldset.xdm_network | filter. With all logs normalized to XDM, incoming traffic is identified by the source IP. Using datamodel dataset = * searches all mapped data, fieldset.xdm_network exposes the XDM network fields, and filtering on xdm.source.ipv4 precisely returns only traffic originating from

Threat Hunting

Question

Options

Adatamodel dataset = * | fields fieldset.xdm_network | filter
Bdatamodel dataset = * | filter XDM.ALIAS.ipv4 = "99.99.99.99"
Cpreset = network_story | filter agent_ip_addresses = "99.99.99.99"
Ddatamodel preset = * | filter XDM.ALIAS.ip = "99.99.99.99"

How the community answered

(61 responses)

A
79% (48)
B
11% (7)
C
7% (4)
D
3% (2)

Explanation

With all logs normalized to XDM, incoming traffic is identified by the source IP. Using datamodel dataset = * searches all mapped data, fieldset.xdm_network exposes the XDM network fields, and filtering on xdm.source.ipv4 precisely returns only traffic originating from

Topics

#XQL#XDM#network hunting#data model

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice