Which section of a parsing rule defines the newly created dataset?

The COLLECT section is the final stage in an XSIAM parsing rule's XQL query. It uses the collect into command to ingest the processed data into a new, specified dataset. This command explicitly defines the vendor.productraw dataset where the parsed logs will be stored, effectively defining the newly created dataset for the incoming data source.

A. RULE: This is the top-level declaration that contains the entire parsing rule logic; it does not define the dataset itself.

C. INGEST: This section specifies the source of the raw logs to be processed, not the destination dataset for the parsed data.

D. CONST: This section is used to declare constant values for reuse within the rule, not for defining the target dataset.

---

1. Palo Alto Networks, Cortex XSIAM Administrator's Guide. "Parsing Rules". The documentation outlines the structure of a parsing rule, showing that the XQL query within the rule concludes with the collect stage. It states, "The collect stage is the last stage in the query and is used to ingest the data into a new dataset." This confirms that COLLECT is the section responsible for defining the target dataset.

2. Palo Alto Networks, XQL Language Reference. "collect". This reference details the collect stage, explaining its syntax: collect into (vendor=, product=, format=). This syntax directly demonstrates that the collect command is used to specify and define the new dataset for ingestion.