[Data Ingestion and Integration] An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction…

The [CONST] section in a Cortex XDR parsing rule is specifically designed for defining reusable constants and expressions. An administrator can declare a named constant, such as a complex regular expression, within this section. This named constant can then be referenced multiple times within the [RULE] section of the same or different parsing rules. This practice promotes consistency in field extraction across various log sources and simplifies the maintenance of the parsing logic by centralizing the definition of reusable patterns.

A. RULE: This section contains the primary parsing logic that extracts fields from logs; it uses reusable constants but does not define them.

B. INGEST: This section is used for metadata, defining the vendor and product to which the rule applies, not for defining reusable logic.

C. FILTER: This section specifies the criteria for which incoming logs the parsing rule should be applied to, acting as a trigger, not a logic definition block.

1. Palo Alto Networks Cortex XDR Administrator's Guide: In the section on "Parsing Rules

" the guide details the structure of a parsing rule. It explicitly states that the [CONST] section is used to "Define constants that you can reuse in the rule." This section allows for defining expressions that can be referenced later in the [RULE] block. (Reference: Cortex XDR Administrator's Guide

"Get Started with Ingestion

" sub-section "Parsing Rules").

2. Palo Alto Networks Cortex XDR Documentation: The documentation on "Create a New Parsing Rule" outlines the different sections. It describes [CONST] as the area to define reusable expressions

which directly addresses the administrator's goal of applying consistent extraction logic. (Reference: Cortex XDR Product Documentation

"Data Ingestion

" "Parsing Rules

" "Create a New Parsing Rule").