Data Sources, Ingestion, and Parsing
The Data Sources, Ingestion, and Parsing domain tests onboarding, normalization, and verification of data. You should know the common ingestion paths-agent, Broker VM syslog and network collection, cloud connectors, and API-based pull-and how raw events become normalized fields that detections can query.
Core rules
- XSIAM normalizes events into the XSIAM Data Model (XDM). Parsers map vendor fields to normalized fields; raw data remains queryable in raw datasets.
- XQL is the query language used to inspect datasets, validate parsers, and build detections. Know the difference between a raw dataset and a normalized view.
- Data source onboarding usually requires: create the collection point, configure the source to send data, add and select the data source and parser in XSIAM, then verify ingestion and field mapping.
- Ingestion methods are source-specific. Do not force syslog through an API connector or assume a cloud connector can read on-prem logs.
- Time zones, timestamps, and duplicate forwarding are common data-quality issues. Normalize to UTC and avoid multiple forwarders.
Worked example
You onboard Palo Alto NGFW traffic logs. Create a syslog receiver on the Broker VM, point the firewall to the broker IP and port, add the NGFW data source in XSIAM, select the built-in parser, and query the raw traffic dataset for recent events. Then query normalized fields such as source IP, destination IP, and action. If fields are null, inspect parser mappings and sample raw events before writing detection logic.
Traps
Selecting a parser because the vendor name matches but the log format differs; testing only new events and not backfill; ignoring parser version changes; assuming normalized fields exist before validation; sending logs to the tenant endpoint without a supported collector.