Elastic Certified SIEM Analyst cheat sheet

Kibana spaces isolate saved objects (detection rules, cases, dashboards, timelines) but never isolate data; role privileges on indices decide which documents a user can read.

Detection alerts are written to the space-scoped index .alerts-security.alerts-<spaceId>, so a rule running in the default space writes to .alerts-security.alerts-default.

Detection rules execute through Kibana's task manager at each rule's configured interval; if Kibana or the task manager is unavailable, no rule runs and no alerts are generated.

Requesting security APIs fails until xpack.security.enabled: true is set; only then do native users, roles, and API keys exist.

Elastic Agent checks in with Fleet Server over HTTPS, default port 8220; Elasticsearch listens on 9200 and Kibana on 5601.

The Elastic Security application is gated by the securitySolution Kibana feature privileges (show, read, alerts, cases, endpoint exceptions, rule management) assigned through roles.

A resilient production topology uses at least three master-eligible nodes plus separate data nodes, with a hot tier for recent indices and a warm tier for older ones.

Cross-cluster search lets a single Kibana and a single detection rule query indices held in remote clusters, which must first be registered with each local node.

Elastic Agent enrolls to Fleet Server with an enrollment token; integrations, outputs, and protections are configured centrally in Fleet policies, not on the host.

Integration data streams are named <type>-<dataset>-<namespace>, e.g. logs-windows.sysmon_operational-default; the default Security data view covers logs-* and metrics-*.

ECS standardizes field names: event.category, event.type, event.outcome, and event.kind describe what happened and are required by most prebuilt rules.

Legacy Beats and Elastic Agent both write ECS-mapped documents into the same data streams, so existing rules continue to match after a migration.

The Custom Logs integration ingests files or syslog into a user-named dataset and produces logs-<dataset>.<namespace> documents queryable like any other integration.

Index templates and component templates created by an integration control mappings, data stream settings, and index lifecycle policy, so mapping changes come from updating the integration.

Fleet Server must be network-reachable from every agent; in self-managed deployments it usually runs on a dedicated host with its own Fleet Server policy.

Fields outside ECS do not break ingestion but are invisible to prebuilt rules until mapped, so custom rules or field overrides are required for them.

Rule types are query, threshold, EQL, ES|QL, machine learning, threat match (indicator), and new terms; each type demands different query and configuration fields.

A rule's query window equals the schedule interval plus an additional lookback, e.g. a 5-minute interval with 1-minute lookback queries now-6m to now to catch delayed events.

Every rule sets a severity (low, medium, high, critical) and a risk score from 0 to 100; both are copied onto each generated alert.

Exceptions hold entries composed of a field, an operator (equals, matches, is in list, exists), and a value; matching events are filtered out before an alert is created.

Alert suppression groups matches by selected fields and emits one alert per group per interval, collapsing repeated identical behavior into a single alert.

EQL rules use sequence by <field> with maxspan= to require ordered events; join requires a shared join key and succeeds regardless of event order.

Alert documents expose kibana.alert.rule.name, kibana.alert.rule.uuid, kibana.alert.severity, kibana.alert.risk_score, and kibana.alert.status for filtering and triage.

Prebuilt rules are installed and updated from the Rules page and need rule-management privilege plus access to the Elastic rule package; custom rules are authored and versioned in the same space.

KQL supports field: value, and/or/not, wildcards, and ranges, but has no regular-expression operator; Lucene syntax must be used for /regex/.

EQL correlates event relationships with sequence ... with maxspan=, optional until, and join; it is the primary language for ordered process and network chains.

ES|QL chains commands with pipes (FROM, WHERE, STATS ... BY, EVAL, SORT) and executes server-side, returning tabular results rather than raw documents.

Timeline accepts drag-and-drop or query-imported events, pinned events, free-text notes, and saved queries; timeline templates predefine columns and filters for reuse.

Discover shows raw matched documents for the selected data view and time range, and its field statistics view exposes top values and distributions for profiling.

event.category: process and event.type: start isolates process-start events from Elastic Defend, while event.category: network and event.type: connection returns connection attempts.

Hunting queries should be scoped by host.name, user.name, or process.entity_id to pivot from one alert into related activity across indices.

Alert status moves from open to acknowledged to closed; closing requires a reason such as duplicate, false positive, true positive, or benign, and never deletes the alert document.

A case stores title, description, tags, severity, assignee, and custom fields; alerts and events are attached to preserve their query and document context.

Connectors (ServiceNow, Jira, Slack, Swimlane, email, webhook) are shared building blocks used both to push cases to external systems and to fire rule notification actions.

Rule actions can execute for every alert, as a summary of the alerts generated during the interval, or on a custom action interval defined per action.

Once a case is pushed to an external system, subsequent case updates synchronize to the external ticket through the same connector.

Endpoint response actions such as isolate host, kill process, and suspend process can be attached to a rule so they run automatically when an alert fires.

The Alerts table supports bulk triage: selecting multiple alerts lets an analyst change status, add tags, assign an owner, or open a case in one operation.

Elastic Defend policies set each protection family (malware, ransomware, memory, behavior) to prevent, detect, or off, configured separately per operating system.

Event collection categories-process, network, file, DLL and registry, security, authentication, driver/device-are toggled per policy to trade visibility against volume.

Host isolation blocks all host network traffic except the Elastic Agent channel to Fleet, so analysts retain telemetry while the machine is contained.

Trusted applications, event filters, and blocklists tune Elastic Defend behaviour and take effect only after the endpoint receives the updated policy.

Elastic Defend process events carry process.entity_id and process.parent.entity_id, which are chained to rebuild the full process tree.

Malware and ransomware prevention require a Platinum or higher subscription; without it Elastic Defend does not enforce prevention on the host.

Network events from Elastic Defend include source.ip, destination.ip, destination.port, and network.transport, enabling rules on unusual outbound connections.

Response actions (isolate, kill process, suspend process) need the endpoint response privileges and a healthy agent checked in to Fleet before they can execute.