[Data Ingestion and Integration] An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the administrator use to define those reusable rules in Cortex XDR?

In Cortex XDR custom parsing rules, the CONST section is used to declare reusable objects—typically regular-expression snippets or field definitions—that can be invoked from any subsequent RULE entries. By centralising those definitions in CONST, the same extraction logic can be applied consistently across multiple data sources without duplicating code, meeting the administrator’s requirement for “reusable rules”.

A. RULE section contains the individual parsing logic for one data source; items defined here are not globally reusable.
B. INGEST defines metadata (vendor, product, etc.) and initial enrichment, not reusable expressions.
C. FILTER is used to discard matching log lines before parsing, not for defining reusable elements.

1. Palo Alto Networks, “Custom Log Parsing Rule Syntax,” Cortex XDR Collector & Integrations Guide, rev. 06-2023, p. 27-28: “Use CONST to define reusable expressions that can be referenced from any rule.”

2. Palo Alto Networks LIVE community article, “Creating CONST Macros in Parsing Rules,” 2022-11, para. 2-3.