If Cortex XSIAM is ingesting logs from a custom application, which is most likely required?

Question

Options

• ADeactivating data modeling
• BCreating a custom BIOC rule
• CBuilding a custom parsing rule
• DSwitching to agentless logging

• A
  5% (2)
• B
  3% (1)
• C
  89% (33)
• D
  3% (1)

Explanation

Custom parsing rules (C) are required when ingesting logs from a custom application because XSIAM doesn't know the structure, field names, or format of proprietary log data out of the box. A parsing rule tells the platform how to extract and normalize fields so the data can be queried, correlated, and used in analytics.

• A is wrong - Data modeling is a normalization layer that maps parsed fields to a schema; deactivating it would reduce visibility, not solve ingestion issues.
• B is wrong - A BIOC (Behavioral Indicators of Compromise) rule is a detection rule used to identify threats after data is already ingested and parsed - it doesn't address the ingestion problem itself.
• D is wrong - Agentless logging refers to a collection method (e.g., syslog, API pull vs. installing an agent), not a solution for parsing unknown log formats.

Memory tip: Think of the pipeline order - collect → parse → model → detect. Custom apps break at the parse step, so the fix must happen there. "Custom app = custom parse rule."

No community discussion yet for this question.