A filter block with the condition artifact.*.cef.sourceAddress !- allows which data to pass forward?

• A. A. Null IP addresses
• B. B. Non-null IP addresses
• C. C. Non-null destinationAddresses
• D. D. Null values

Answer: (B)

The filter condition artifact.*.cef.sourceAddress !- indicates that any artifact that contains a cef.sourceAddress field with a non-null value will be allowed to pass forward. The !- operator signifies a "not null" condition, meaning that only values that are non-null will be permitted.

In this context, when you apply this filter to your data, you are explicitly allowing all non-null IP addresses to pass through the filter while filtering out those that have a null value. Since the question is specifically targeting what types of data the filter allows forward, it correctly identifies non-null IP addresses as the data that can continue through the processing chain.

The other choices do not align with the filter's purpose of allowing only non-null values. The condition does not address destinationAddresses or null values in a way that would enable them to pass through the filter. Thus, the focus on non-null IP addresses is the key point in understanding this filter's functionality.