To differentiate four regional NAS log sources for SecOps, which configuration assigns a unique ingestion label per log source?

• A. Configure feed management to pull data and configure an ingestion label per log source.
• B. Configure a Bindplane agent and an ingestion label per log source.
• C. Configure feed management to pull data from each location and configure a namespace per log source.
• D. Configure a Bindplane agent collecting Syslog from each location and configure a namespace per log source.

Answer: (A)

Tagging logs at ingestion with a unique label for each log source gives you consistent, searchable, and routable metadata across all four regional NAS sources. When feed management pulls data from every location, applying an ingestion label per log source lets you distinguish events from Region A, Region B, Region C, and Region D in a single stream. This makes writing security analytics, alerts, and dashboards straightforward because you can filter or route by that label without relying on separate storage boundaries or multiple agents. It also simplifies governance and access controls, since each region’s data can be tracked and managed by its ingestion label throughout the pipeline.

Using a namespace per log source bundles the separation into a storage or processing boundary rather than a queryable, cross-cutting identifier. While namespaces isolate data, they don’t provide the uniform, flexible tagging that ingestion labels offer for analytics and alerting. Relying on a BindPlane agent with per-source namespaces has similar drawbacks in terms of cross-source correlation and unified policy application, since the core need is a single, consistent tag attached at ingestion time.