Q2
Single choice
Logs are reaching the security platform, but a detection cannot use the source IP because it remains embedded in an unmapped nested field. Which data-processing stage needs correction?