XSIAM-ENGINEER · Question #8
A security engineer notices that in the past week ingestion has spiked significantly. Upon investigating the anomaly, it is determined that a custom application developed in-house caused the spike…
The correct answer is A. Parsing rule to drop the unnecessary data at the Broker VM. To reduce ingestion from the custom application, the engineer should configure a parsing rule on the Broker VM. Parsing rules can be set to drop unnecessary data before it is ingested into Cortex XSIAM, preventing wasteful log volume and optimizing system efficiency.
Question
A security engineer notices that in the past week ingestion has spiked significantly. Upon investigating the anomaly, it is determined that a custom application developed in-house caused the spike. The custom application is sending syslog to the Broker VM Syslog Collector applet. The engineer consults with the SOC analyst, who determines that 90% of the logs from the custom application are not used. What can the engineer configure to reduce the ingestion?
Options
- AParsing rule to drop the unnecessary data at the Broker VM
- BData model rule to drop the unnecessary data
- CCorrelation rule on the Cortex XSIAM server to drop the unnecessary data
- DData model rule to map the useful data
How the community answered
(39 responses)- A82% (32)
- B5% (2)
- C10% (4)
- D3% (1)
Explanation
To reduce ingestion from the custom application, the engineer should configure a parsing rule on the Broker VM. Parsing rules can be set to drop unnecessary data before it is ingested into Cortex XSIAM, preventing wasteful log volume and optimizing system efficiency.
Topics
Community Discussion
No community discussion yet for this question.