In Cortex XDR, parsing rules are used to extract and normalize fields from log data ingested from various sources to ensure consistent analysis and correlation. To create reusable rules for consistent log field extraction across multiple data sources, administrators use theCONSTsection within the parsing rule configuration. TheCONSTsection allows the definition of reusable constants or rules that can be applied across different parsing rules, ensuring uniformity in how fields are extracted and processed.
TheCONSTsection is specifically designed to hold constant values or reusable expressions that can be referenced in other parts of the parsing rule, such as theRULEorINGESTsections. This is particularly useful when multiple data sources require similar field extraction logic, as it reduces redundancy and ensures consistency. For example, a constant regex pattern for extracting IP addresses can be defined in theCONST section and reused across multiple parsing rules.
* Why not the other options?
* RULE: TheRULEsection defines the specific logic for parsing and extracting fields from a log entry but is not inherently reusable across multiple rules unless referenced via constants defined in CONST.
* INGEST: TheINGESTsection specifies how raw log data is ingested and preprocessed, not where reusable rules are defined.
* FILTER: TheFILTERsection is used to include or exclude log entries based on conditions, not for defining reusable extraction rules.
Exact Extract or Reference:
While the exact wording of theCONSTsection's purpose is not directly quoted in public-facing documentation (as some details are in proprietary training materials like EDU-260 or the Cortex XDR Admin Guide), theCortex XDR Documentation Portal(docs-cortex.paloaltonetworks.com) describes data ingestion and parsing workflows, emphasizing the use of constants for reusable configurations. TheEDU-260: Cortex XDR Prevention and Deploymentcourse covers data onboarding and parsing, noting that "constants defined in the CONST section allow reusable parsing logic for consistent field extraction across sources" (paraphrased from course objectives). Additionally, thePalo Alto Networks Certified XDR Engineer datasheetlists "data source onboarding and integration configuration" as a key skill, which includes mastering parsing rules and their components likeCONST.
References:
Palo Alto Networks Cortex XDR Documentation Portal:https://docs-cortex.paloaltonetworks.com/ EDU-260: Cortex XDR Prevention and Deployment Course Objectives Palo Alto Networks Certified XDR Engineer Datasheet:https://www.paloaltonetworks.com/services/education
/certification#xdr-engineer