XSIAM-ENGINEER · Question #55
Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW." An engineer wants to create an alert for this scenario. Correlation rule settings include: - Time…
The correct answer is D. preset = metrics_view | filter _vendor = "PANW" and _product = "NGFW" and _reporting_device_name = "MainFW" | comp sum(total_event_count) as total_events by _reporting_device_name | filter total_events = 0. The correct query is the one using preset = metrics_view with comp sum(total_event_count) as total_events by _reporting_device_name and filtering total_events = 0. This query directly checks event counts reported by the NGFW ("MainFW"). If no logs are received in the last 30…
Question
Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW.” An engineer wants to create an alert for this scenario. Correlation rule settings include:
- Time Schedule: Every 30 minutes
- Query Timeframe: 30 minutes
- Action: Generate alert
- Alert Name: No logs received from MainFW in the past 30 minutes
Which query should be used in the correlation rule? A. B. C. D.
Options
- Adataset = collection_auditing | filter collector_type = "NGFW" and instance = "MainFW" | comp count_distinct(description) as total_events by instance | filter total_events = 0
- Bpreset = metrics_view | filter _vendor = "PANW" and _product = "NGFW" and _reporting_device_name = "MainFW" | comp sum(total_event_count) as total_events by _reporting_device_name | filter total_events = 0
- Cdataset = collection_auditing | filter collector_type = "NGFW" and instance = "MainFW" | comp values(description) as total_events by instance | filter total_events = 0
- Dpreset = metrics_view | filter _vendor = "PANW" and _product = "NGFW" and _reporting_device_name = "MainFW" | comp sum(total_event_count) as total_events by _reporting_device_name | filter total_events = 0
How the community answered
(28 responses)- A21% (6)
- B14% (4)
- C4% (1)
- D61% (17)
Explanation
The correct query is the one using preset = metrics_view with comp sum(total_event_count) as total_events by _reporting_device_name and filtering total_events = 0. This query directly checks event counts reported by the NGFW ("MainFW"). If no logs are received in the last 30 minutes, the total event count will be 0, which triggers the correlation rule
Topics
Community Discussion
No community discussion yet for this question.