Which component is responsible for identifying the correct parsing rule to apply for a unique data source in Cortex XSIAM?

Question

Options

• AData model rule
• BLog ingestion filter
• CParsing rule tag
• DParsing classifier

• A
  3% (1)
• B
  6% (2)
• D
  92% (33)

Explanation

Parsing Classifier (D) is the component that identifies which parsing rule to apply for a given data source. In Cortex XSIAM, when raw logs arrive, the parsing classifier examines the log data and maps it to the appropriate parsing rule - essentially acting as the routing mechanism that matches incoming data to its correct parser.

• A (Data model rule) is wrong because data model rules define how parsed fields map to a normalized schema, not how to select the right parser.
• B (Log ingestion filter) is wrong because ingestion filters control which log data gets ingested (inclusion/exclusion), not how it gets parsed.
• C (Parsing rule tag) is wrong because tags are used to label or organize parsing rules, not to perform the identification/selection logic itself.

Memory tip: Think of the parsing classifier like a mail sorting machine - it classifies each piece of mail (log) and routes it to the right handler (parsing rule). The word "classifier" inherently implies identification and routing, which is exactly its function.

No community discussion yet for this question.