XDR-ENGINEER practice question 10 of 10

[Data Ingestion and Integration] Which method will drop undesired logs and reduce the amount of data being ingested?

Answer options

A: [COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] * drop _raw_log contains "undesired logs";

B: [INGEST:vendor="vendor", product="product", target_dataset="vendor_product_raw",no_hit=drop] * filter _raw_log not contains "undesired logs";

C: [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs"; Correct answer

D: [INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] * filter _raw_log not contains "undesired logs";

Correct Answer:

C. [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs";

Explanation

The most efficient place to discard unwanted events is in the COLLECT stage—before data is forwarded to the Cortex cloud—using the drop transformation. Syntax: [COLLECT: vendor="..." product="..." targetdataset="…" nohit=drop] drop rawlog contains “…string…”; Because the record is dropped at collection time, it is never ingested or billed, directly reducing data volume. Option C follows this exact syntax.

Why Incorrect

A. ‘targetbrokers’ is not a valid COLLECT parameter; rule will not compile, so logs are not dropped.
B. INGEST stage processes data after it has reached the cloud; filtering there does not lower ingestion volume.
D. Uses nohit=keep and thus retains unmatched logs; also still operates at INGEST, so ingestion cost remains.

References

1. Palo Alto Networks, “Cortex XSIAM Admin Guide 2.4”, section “Create Broker Collector Parsing Rules”, pp. 158-160 (example with drop in COLLECT).

2. Palo Alto Networks LIVE Docs, KB “Reduce Ingested Log Volume with the drop Operator”, rev. 2023-05-19.

Keep practicing

Take the free XDR-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test