I85PREP
⌘ K
Elastic Certified Analyst study materials
Elastic Certified Analyst study resources

Elastic Certified Analyst: Security: SIEM detection, endpoint protection, and native automation

Elastic Certified Analyst · Work through your exam, one topic at a time.

All guide sections

Security: SIEM detection, endpoint protection, and native automation

What this domain covers

Security tests the detection pipeline in Elastic Security: getting data in and normalized, writing and tuning rules, investigating alerts, and using endpoint and automation features without turning a detection into an outage.

Detection pipeline rules

  • Ingestion runs through Elastic Agent integrations managed in Fleet. Prebuilt rules assume ECS-normalized fields such as event.category, event.action, process.name, and user.name, so an unparsed custom source fails rules silently.
  • Rule types include query, EQL, threshold, indicator match for threat intelligence, new terms, machine learning, and ES|QL. Every rule has an interval and a lookback from; the lookback must cover the interval or events fall into gaps between runs.
  • EQL expresses correlation, for example: sequence by user.name with maxspan=10m [ authentication where event.outcome == 'failure' ] with runs=5 [ authentication where event.outcome == 'success' ].
  • Alerts are written to the hidden .alerts-security.alerts-<space> index and carry kibana.alert.* fields. Alerts, rules, and cases are space-scoped.
  • Rule exceptions suppress known-benign activity for one rule without disabling it; alert suppression collapses repeated alerts on a chosen field combination.
  • Elastic Defend covers malware, ransomware with canary files, memory threats, and behavioral protections, each in detect or prevent mode, and exposes response actions: isolate host, kill process, suspend process.
  • Response actions can be attached to endpoint rules so containment happens automatically. Cases and connectors such as Slack, Jira, and ServiceNow carry the human workflow, and Attack Discovery uses an LLM to group alerts into attack narratives for triage.

Worked example

Detect password spraying that eventually succeeds. A threshold rule counting failed logons per user.name never sees the success. Write an EQL sequence: five failures for the same user within ten minutes, followed by a success inside the same maxspan. Add an exception for the vulnerability scanner account that fails logons by design, and map the rule to MITRE ATT&CK T1110. Only attach an isolate-host response action after checking blast radius - auto-isolating a domain controller is an outage, not a containment. The reasoning: sequence logic captures the relationship between events, the exception removes the dominant false positive, and automation is gated on the cost of a wrong action.

Traps

Setting from shorter than interval, creating blind spots. Writing exceptions against fields that are not ECS-normalized. Assuming prevent mode is active by default; in detect mode malware is alerted, not blocked. Expecting prebuilt rules to fire without the matching integration installed and parsed. Creating rules in a different Kibana space from the analysts who need them. Running indicator match rules against a large threat index without watching rule duration and max_signals.