What is the expected behavior when querying a data model with no specific fields specified in the query?

The correct answer is D. The xdm_core fieldset will be returned by default. When you run a datamodel query without a fields clause, XQL automatically returns the default xdm_core fieldset, which contains the core normalized XDM fields.

Threat Hunting

Question

Options

AThe default dataset=xdr_data fields will be returned.
BThe query will error out and not run.
CNo fields will be returned by default.
DThe xdm_core fieldset will be returned by default.

How the community answered

(43 responses)

B
5% (2)
C
2% (1)
D
93% (40)

Explanation

When you run a datamodel query without a fields clause, XQL automatically returns the default xdm_core fieldset, which contains the core normalized XDM fields.

Topics

#data model#XDM fieldset#XQL default behavior#query results

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice