The correct approach is to install a Broker VM in the environment and configure its CSV Collector applet to ingest the .csv log files directly from the Ubuntu server. This enables secure ingestion of custom application logs into Cortex XSIAM without modifying the application or requiring an XDR agent on the server.

In a Cortex XSIAM parsing rule, the COLLECT section defines the newly created dataset. This section specifies how the parsed fields and data should be structured and stored for further use in analytics and queries.

In Cortex XSIAM's Alert Layout Builder, the "War Room" and "Work Plan" tabs are optional and can be removed, while the "Alert Info" tab is mandatory and cannot be deleted. This ensures that essential alert details are always retained, while collaboration and workflow tabs can be customized.

Setting indicator extraction to None prevents automatic extraction of indicators from the task output. However, commands such as !domain are enrichment commands, and their indicator mapping flow still runs so enrichment results can be mapped to the indicator object.

For structured logs such as CEF and JSON, Cortex XSIAM parses key-value fields into structured columns/datasets for efficient XQL querying and analytics, while preserving the original raw event for reference and troubleshooting.