To enable authentication integration for automated user provisioning in Cortex XSIAM, what steps are essential?

After configuring Cloud Identity Engine, which dataset should be queried to validate proper ingestion of Active Directory data?

An engineer is integrating third-party logs into Cortex XSIAM and observes that data transformations during ingestion are causing inconsistencies in the Analytics Engine. The engineer needs to ensure that logs are normalized to a consolidated schema with predefined data types to support out-of-the-box analytics.
Which feature should be used to achieve this normalization?

What is the primary purpose of a Lookup Dataset in Cortex XSIAM?

What is the role of "in" in the query line below?
action_local_port in (1122, 2234)