300-215 Question 102
Single answerYou are investigating a potential data exfiltration event and need to parse logs from Cisco Secure Network Analytics to identify anomalous traffic patterns. Which of the following scripts would correctly parse JSON-formatted logs and filter for traffic originating from a specific IP address range (e.g., 192.168.1.0/24)?
- A
A Python script that uses the 'json' module to load log data and filters entries based on the source IP field matching the specified range.
- B
A Bash script using 'grep' to search for the IP range in the raw log files without any additional filtering.
- C
A PowerShell script that uses 'ConvertFrom-Json' to parse log data and filters the source IP field using a regular expression.
- D
A Python script that uses 'os' module to scan log files for any mention of the IP range, but does not parse the JSON format.
Show answer and explanation
Correct answer: A
Explanation
The correct approach to parsing JSON-formatted logs is to use a Python script with the 'json' module, as it allows structured data handling and precise filtering based on fields like source IP. While other tools like Bash and PowerShell can work with JSON to some extent, they are either less efficient or do not provide the necessary structure for accurate analysis in this scenario.
- A. Correct.
This is the correct answer. Using the Python 'json' module allows proper parsing of JSON-formatted logs, and filtering can be done programmatically to match the IP range.
- B. Incorrect.
While 'grep' can search for text, it cannot fully parse JSON-formatted logs, which can lead to inaccurate or incomplete filtering of the data.
- C. Incorrect.
Although PowerShell's 'ConvertFrom-Json' is capable of parsing JSON, using a regular expression for IP filtering is less efficient and prone to errors compared to Python's built-in tools for handling IP ranges.
- D. Incorrect.
The 'os' module in Python is not intended for parsing JSON data. Using it to search for text in log files without parsing the JSON format would result in incomplete or incorrect analysis.