Exam SC-200 topic 3 question 63 discussion

https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers

To support excluding built-in source-specific parsers, ASIM uses a watchlist. https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers#set-up-your-workspace

ChatGTP: ✅ Correct answer: B. a watchlist 🧾 Explanation: To exclude a built-in, source-specific ASIM parser from a unified ASIM parser in Microsoft Sentinel, the recommended approach is to: 👉 Use a Watchlist Microsoft Sentinel uses watchlists to provide custom inclusion/exclusion logic for various features, including ASIM parsers. You can create a watchlist that lists the parsers you want to exclude, and then reference that watchlist in custom ASIM logic or configurations.

on exam 2024/April

To support excluding built-in source-specific parsers, ASIM uses a watchlist.

Correct Option

To support excluding built-in source-specific parsers, ASIM uses a watchlist. Deploy the watchlist to your Microsoft Sentinel workspace from the Microsoft Sentinel GitHub repository. To define source type for built-in and custom parsers, ASIM uses a watchlist. Deploy the watchlist to your Microsoft Sentinel workspace from the Microsoft Sentinel GitHub repository.

Answer B To modify an existing, built-in source-specific parser: 1 Create a custom parser based on the original parser and add it to the built-in parser. 2 Add a record to the ASim Disabled Parsers watchlist. 3 Define the CallerContext value as Exclude<parser name>, where <parser name> is the name of the unifying parsers you want to exclude the parser from. 4 Define the SourceSpecificParser value Exclude<parser name>, where <parser name>is the name of the parser you want to exclude, without a version specifier. (From: https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers)

B. A watchlist

On exam 2-11-2023

A. an analytic rule An analytic rule allows you to specify the conditions under which data is collected and analyzed. By creating an analytic rule in Workspace1, you can exclude a built-in, source-specific ASIM parser from a built-in unified ASIM parser by specifying conditions that exclude the data generated by that parser. For example, you could create an analytic rule that filters out all events generated by the built-in, source-specific parser you want to exclude, by using the "where" clause, this way the unified parser will not process the events generated by that source-specific parser. While the other options (B, C, D) are useful for different purposes, but none of them can be used to exclude a specific parser from a unified parser.