Câu 16: XSIAM-ENGINEER: Palo Alto Networks XSIAM Engineer

An engineer wants to onboard data from a third-party vendor’s firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data. How can the analytics capabilities of Cortex XSIAM be used on the data?

1. A. Create a behavioral indicator of compromise (BIOC) rule on the network fields (source IP, source port, target IP, target port, IP protocol).
2. B. Create a data model rule with network fields mapped (source IP, source port, target IP, target port, IP protocol). — đáp án hiện tại
3. C. Create a correlation rule on the network fields (source IP, source port, target IP, target port, IP protocol).
4. D. Create a parsing rule and ensure the network fields exist (source IP, source port, target IP, target port, IP protocol).