Which type of property must the administrator create?

An administrator needs to extract a property from an intrusion detection system (IDS) log. Using a regular expression, the administrator wants to extract a specific part of the log showing the matching “policy ID” of the IDS.

Which type of property must the administrator create?
A . Custom event property
B . Custom flow property
C . Custom asset property
D . Normalized event property

View Answer

Answer: D