Which option ensures each NAS log source is uniquely tagged in SecOps by applying an ingestion label?

• A. Configure feed management to pull data and configure an ingestion label per log source.
• B. Configure feed management to pull data from each location and configure a namespace per log source.
• C. Configure a Bindplane agent collecting Syslog from each location and configure a namespace per log source.
• D. Configure a Bindplane agent and an ingestion label per log source.

Answer: (A)

Ingestion tagging is the mechanism that assigns a source identity to every event as it enters SecOps, so you can reliably group, search, and route data by where it came from. Applying an ingestion label for each NAS log source ensures every event carries a unique, source-specific tag throughout the pipeline, which is essential for clear attribution and accurate analytics across many devices. Using feed management to pull data and attach a label per log source provides a scalable, centralized way to enforce that tagging consistently as data flows in.

Using a namespace per log source offers logical separation but doesn’t attach an event-level tag that travels with all data from that source, making attribution less precise. A BindPlane agent setup can collect data, but without tying every source through a process that applies an ingestion label per source, tagging may become inconsistent or incomplete. So the combination of feed management with an ingestion label per log source delivers the correct, scalable approach to uniquely tag NAS sources in SecOps.