Detection and Data Onboarding
This domain tests whether you can bring a data source into the platform and turn raw telemetry into dependable detections. The exam focuses on the onboarding pipeline, data quality, and the order of operations: parse first, normalize second, detect last.
Core onboarding rules
- Pipeline: ingestion → parsing → normalization to XDM → datasets → modeling and detection rules.
- Raw datasets preserve source fields; normalized datasets use the platform data model. Query both with XQL to confirm what arrived and how it was mapped.
- Prebuilt parsers and content packs cover common sources, but custom parsing rules are needed when field formats differ.
- Monitor collector health, ingestion volume, parse failures, event time versus ingest time, and duplicate feeds.
- Detection content includes IOC, BIOC, analytics, and correlation rules. Test against historical data before enabling broadly.
Worked example
Onboarding Palo Alto NGFW syslog: configure the Broker VM syslog receiver, confirm events arrive, and query the raw dataset with a small XQL limit. Verify timestamps, source and destination addresses, ports, and action fields. Apply or build the parsing rule, then confirm the normalized XDM fields. Only after that enable the traffic detection rule and tune exclusions for known scanners. The reasoning is deliberate validation at each stage; a detection built on unmapped fields produces silent false negatives.
Traps that cost marks
- Writing detection logic before confirming parsing and normalization.
- Ignoring timezone offsets or confusing event time with ingestion time.
- Double-ingesting the same feed through agent and API.
- Assuming every source field exists after normalization.
- Failing to monitor ingestion gaps that make dashboards look quiet but wrong.