XSIAM-ENGINEER Question #38: Real Exam Question with Answer & Explanation

The correct answer is B. For structured logs, like CEF, LEEF, and JSON, it decouples the key-value pairs and saves them. Cortex XSIAM ingests structured third-party logs (such as CEF, LEEF, and JSON) by breaking down the key-value pairs and saving them in a normalized table format. This enables efficient correlation, analytics, and query performance across diverse log sources while preserving data

Question

How will Cortex XSIAM help with raw log ingestion from third-party sources in an existing infrastructure?

Options

AAny structured logs coming into it are left completely unchanged, and only metadata is added to
BFor structured logs, like CEF, LEEF, and JSON, it decouples the key-value pairs and saves them
CAny unstructured logs coming into it are left completely unchanged, and metadata is not added to
DFor unstructured logs, it decouples the key-value pairs and saves them in a table format.

Explanation

Cortex XSIAM ingests structured third-party logs (such as CEF, LEEF, and JSON) by breaking down the key-value pairs and saving them in a normalized table format. This enables efficient correlation, analytics, and query performance across diverse log sources while preserving data

Community Discussion

No community discussion yet for this question.

Full XSIAM-ENGINEER Practice