A critical XSIAM use case involves detecting account compromise by correlating failed login attempts from unusual geographic locations with successful logins shortly after. The raw 'Authentication' logs provide 'source ip', 'username', and 'authentication status'. The existing content optimization rules map 'authentication status' to 'success' or 'failure'. However, the 'source ip' needs to be enriched with accurate geo-location, and then this geo-location information needs to be available for fast correlation queries. Due to the high volume of logs, any solution must prioritize ingestion-time processing to minimize query-time overhead. Which data modeling strategy is optimal?
Select one answer.
AI Answer Explanation & Exam Tips
Instant breakdown of key concepts, distractor analysis, and quick exam memory tricks.
Purchase Full Access to view answer options & explanation
The first 112 questions in this bank are completely free. Unlock Full Access on the exam page to view all answer choices, verified answers, explanations, and community discussions for all 373 questions.
