Palo_Alto_Networks
XSIAM-ENGINEER · Question #55
Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW." An engineer wants to create an alert for this scenario. Correlation rule settings include: - Time S
Sign in or unlock XSIAM-ENGINEER to reveal the answer and full explanation for question #55. The question stem and answer options stay visible for context.
Detection Engineering and Correlation
Question
Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW.” An engineer wants to create an alert for this scenario. Correlation rule settings include:
- Time Schedule: Every 30 minutes
- Query Timeframe: 30 minutes
- Action: Generate alert
- Alert Name: No logs received from MainFW in the past 30 minutes
Which query should be used in the correlation rule? A. B. C. D.
Options
- Adataset = collection_auditing | filter collector_type = "NGFW" and instance = "MainFW" | comp count_distinct(description) as total_events by instance | filter total_events = 0
- Bpreset = metrics_view | filter _vendor = "PANW" and _product = "NGFW" and _reporting_device_name = "MainFW" | comp sum(total_event_count) as total_events by _reporting_device_name | filter total_events = 0
- Cdataset = collection_auditing | filter collector_type = "NGFW" and instance = "MainFW" | comp values(description) as total_events by instance | filter total_events = 0
- Dpreset = metrics_view | filter _vendor = "PANW" and _product = "NGFW" and _reporting_device_name = "MainFW" | comp sum(total_event_count) as total_events by _reporting_device_name | filter total_events = 0
Unlock XSIAM-ENGINEER to see the answer
You've previewed enough free XSIAM-ENGINEER questions. Unlock XSIAM-ENGINEER for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#correlation rules#log gap detection#NGFW monitoring#XQL query