A city SOC wants one brute-force correlation to cover both the Palo Alto and Cisco ASA in front of the permitting portal. Analysts still paste vendor field names into every search. What is the SIEM best-practice next step?
Select an answer to reveal the explanation.
Short Explanation
Think of CIM like one shared street-address book for every brand of firewall. Once Palo and Cisco both speak src, dest, and action, one search covers both boxes. Pasting vendor fields into every search is rewriting the phone book for each new appliance.
Full Explanation
A city SOC that wants one brute-force correlation across Palo Alto and Cisco ASA in front of the permitting portal should normalize both sourcetypes to the CIM Network_Traffic model, then correlate on shared fields such as src, dest, and action. That is SIEM best practice: map once, search many vendors with portable field names. Analysts stop pasting vendor-specific extractions into every correlation search, and new civic appliances join the same search surface after CIM mapping. Shared CIM fields are how Enterprise Security content stays maintainable.
Writing a unique field extraction for each vendor inside every correlation search fails by concept: it does not scale and reintroduces vendor lock-in on every detection. Building a separate Enterprise Security app per firewall vendor so searches never share field names fragments the SOC and defeats CIM's purpose. Exporting raw syslog to a spreadsheet and joining vendor columns after each incident abandons the SIEM for offline busywork and loses scheduled detection value.
Exam caveat: multi-vendor firewall stems expect CIM Network_Traffic mapping plus shared fields—not per-search extractions, per-vendor ES apps, or spreadsheet joins.
Operational check: confirm both Palo Alto and ASA sourcetypes are tagged and mapped to Network_Traffic, run a single correlation using src, dest, and action against the permitting portal paths, and verify findings fire for both vendors without vendor-field paste-ins.