XSIAM-ENGINEER · Question #48
An engineer wants to onboard data from a third-party vendor's firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to…
The correct answer is B. Create a data model rule with network fields mapped (source IP, source port, target IP, target port. To leverage Cortex XSIAM analytics on custom-ingested firewall data, a data model rule must be created with the key network fields (source IP, source port, target IP, target port, IP protocol) mapped. This enables the data to align with XSIAM's analytics engine and be used for…
Question
An engineer wants to onboard data from a third-party vendor’s firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data. How can the analytics capabilities of Cortex XSIAM be used on the data?
Options
- ACreate a behavioral indicator of compromise (BIOC) rule on the network fields (source IP, source
- BCreate a data model rule with network fields mapped (source IP, source port, target IP, target port,
- CCreate a correlation rule on the network fields (source IP, source port, target IP, target port, IP
- DCreate a parsing rule and ensure the network fields exist (source IP, source port, target IP, target
How the community answered
(53 responses)- A6% (3)
- B58% (31)
- C25% (13)
- D11% (6)
Explanation
To leverage Cortex XSIAM analytics on custom-ingested firewall data, a data model rule must be created with the key network fields (source IP, source port, target IP, target port, IP protocol) mapped. This enables the data to align with XSIAM's analytics engine and be used for BIOCs, correlation rules, and advanced detections.
Topics
Community Discussion
No community discussion yet for this question.