ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
A DevSecOps team ingests web-server, application, IDS, and cloud audit logs into a SIEM, but correlation searches miss links because each source labels the same attribute (such as source IP) differently. Which action will best enable reliable cross-source analytics without rewriting existing correlation rules?
Compress and archive historical logs to reduce the SIEM's index size before running correlation searches.
Reconfigure the IDS to output plain-text logs instead of JSON to simplify parsing.
Expand the SIEM query time window to capture longer dwell times for potential intrusions.
Normalize incoming events to a common schema (for example, CEF or OCSF) during ingestion so field names are consistent across sources.
When different log sources use inconsistent field names, the SIEM treats identical data as separate attributes and fails to correlate events accurately. Applying a standardized event schema-such as Common Event Format (CEF), Elastic Common Schema (ECS), or the Open Cybersecurity Schema Framework (OCSF)-during ingestion normalizes field names and data types. With normalized data, existing correlation and aggregation rules can operate on uniform fields, eliminating the need to rewrite each rule. Compressing archives, switching to plain-text logs, or merely extending the query window do not address the underlying field-mapping problem and therefore will not restore reliable analytics.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a SIEM?
Open an interactive chat with Bash
What are standardized event schemas like CEF and OCSF?
Open an interactive chat with Bash
Why is normalizing data important for SIEM correlations?
Open an interactive chat with Bash
What is a SIEM, and why is it important for cybersecurity?
Open an interactive chat with Bash
What are common schemas like CEF or OCSF, and why are they useful?
Open an interactive chat with Bash
How does normalizing log data improve SIEM analytics?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)