Question 26
A security engineer notices that in the past week ingestion has spiked significantly. Upon investigating the anomaly, it is determined that a custom application developed in-house caused the spike. The custom application is sending syslog to the Broker VM Syslog Collector applet. The engineer consults with the SOC analyst, who determines that 90% of the logs from the custom application are not used. What can the engineer configure to reduce the ingestion?
- Parsing rule to drop the unnecessary data at the Broker VM
- Data model rule to drop the unnecessary data
- Correlation rule on the Cortex XSIAM server to drop the unnecessary data
- Data model rule to map the useful data