Log and Data Source Management
What the exam tests
This domain tests onboarding a source end to end: collection, parsing, normalization, entity assignment, and health validation.
Core rules
- Distinguish Log Source Type (template: parser, processing order, fields) from Log Source (configured instance: IP, port, agent, entity).
- Collection methods include System Monitor agent, syslog, file, SNMP, and API; choose based on the source and network path.
- The Message Processing Engine (MPE) runs parsing, normalization, classification, and enrichment. Log Processing Policy determines which MPE rules apply.
- Normalization maps vendor fields to LogRhythm common fields such as source IP, destination IP, user, and object.
- Use Learning Mode or test parsing before production; validate with Tail or Search and Log Source Health.
- Log Source Virtualization splits one feed into multiple virtual sources when a device sends mixed formats.
Worked example
A firewall sends syslog but events appear unparsed. Check the Log Source Type and parser; the UDP or TCP port and source IP; the time zone; MPE rule hits and processing order; and whether the source is in Learning Mode. Fix the parser or source type before changing analytics rules, because unparsed logs cannot drive reliable alarms.
Traps
- Assigning the wrong Entity, which hides data from the right analysts.
- Using a generic syslog type when a vendor-specific type exists.
- Ignoring time zone drift, which breaks sequence and threshold rules.
- Leaving a source in Learning Mode indefinitely.
- Assuming collection success means parsing success.