Exact Extract: Study Guide p.39-p.41: logs are saved first, and parsers are needed to normalize raw logs into standardized fields.
Technical Deep Dive: The correct answer is C. FortiAnalyzer does not discard a log simply because a matching parser is unavailable. The received log is still saved in the FortiAnalyzer log workflow. However, normalization requires a parser that can extract fields and map them into FortiAnalyzer’s common schema. Without that parser, the log remains stored but not normalized. Option A is too destructive. Option B assumes a generic parser is automatically applied. Option D confuses storage/archive state with parser availability.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit