An administrator has configured a Cortex XDR data ingestion rule for a custom log source, but fields are appearing under the 'general_fields' object rather than their designated mapped schema columns. What is the most likely reason for this parsing failure?
Trap 1: The log forwarding protocol must be changed from HTTPS to UDP
Protocol choice does not dictate schema mapping success.
Trap 2: The Cortex XDR agent license does not support custom parsing
Custom log mapping is a standard feature of Cortex XDR data integration.
- A
The log forwarding protocol must be changed from HTTPS to UDP
Why wrong: Protocol choice does not dictate schema mapping success.
- B
The Cortex XDR agent license does not support custom parsing
Why wrong: Custom log mapping is a standard feature of Cortex XDR data integration.
- C
The custom log mapping configuration has incorrect field names or unmatched JSON/regex keys
Mismatched field names or regex extraction groups prevent correct parsing into schema columns.
- D
The Broker VM needs to be rebooted to apply schema updates
Schema mapping updates take effect automatically, but Broker VM service restarts are not the primary cause of mapping mismatches.