How will Cortex XSIAM help with raw log ingestion from third-party sources in an existing infrastructure?

The correct answer is B. For structured logs, like CEF, LEEF, and JSON, it decouples the key-value pairs and saves them. Cortex XSIAM ingests structured third-party logs (such as CEF, LEEF, and JSON) by breaking down the key-value pairs and saving them in a normalized table format. This enables efficient correlation, analytics, and query performance across diverse log sources while preserving data

Data Ingestion and Log Management

Question

Options

AAny structured logs coming into it are left completely unchanged, and only metadata is added to
BFor structured logs, like CEF, LEEF, and JSON, it decouples the key-value pairs and saves them
CAny unstructured logs coming into it are left completely unchanged, and metadata is not added to
DFor unstructured logs, it decouples the key-value pairs and saves them in a table format.

How the community answered

(29 responses)

B
90% (26)
C
3% (1)
D
7% (2)

Explanation

Cortex XSIAM ingests structured third-party logs (such as CEF, LEEF, and JSON) by breaking down the key-value pairs and saving them in a normalized table format. This enables efficient correlation, analytics, and query performance across diverse log sources while preserving data

Topics

#log ingestion#structured logs#CEF LEEF JSON#third-party data sources

Community Discussion

No community discussion yet for this question.

Full XSIAM-ENGINEER Practice