Elastic Certified SIEM Analyst flashcards
Elastic Certified SIEM Analyst · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Kibana space isolation
- Spaces separate saved objects such as dashboards, detection rules, and cases, but they do not restrict access to underlying index data; role index privileges do that.
- Detection alerts index name
- Alerts are stored per space in `.alerts-security.alerts-<spaceId>`, so the default space writes its alerts to `.alerts-security.alerts-default`.
- Detection engine scheduler
- Kibana's task manager runs detection rules at each rule's interval; if Kibana is down, executions are missed and no alerts are generated.
- Serverless security project
- A serverless Security Analytics project removes cluster sizing; you configure ingestion and detections while Elastic manages scaling, storage, and index lifecycle.
- Elasticsearch security enablement
- Setting `xpack.security.enabled: true` activates authentication and role-based access control, which is a prerequisite for all Elastic Security features.
- Cross-cluster search for security
- Remote clusters can be searched from one Kibana once cross-cluster search is configured, letting a single detection rule query logs held in multiple clusters.
- Elastic Agent enrollment token
- Fleet issues enrollment tokens that an Elastic Agent uses at install time to authenticate to Fleet Server and receive its assigned policy.
- Data stream naming convention
- Integration data lands in the pattern `<type>-<dataset>-<namespace>`, for example `logs-windows.sysmon_operational-default` for Windows Sysmon events in the default namespace.
- Elastic Common Schema fields
- ECS standardizes field names so that `event.category`, `event.type`, and `event.outcome` describe what happened consistently across every integration.
- Fleet Server role
- Fleet Server is the control plane endpoint that Elastic Agents connect to; it distributes policies, receives check-ins, and reports agent health status.
- Custom logs integration
- Onboards files or syslog into a chosen dataset, producing `logs-<dataset>.<namespace>` documents that detection rules can query like any integration data.
- Threshold rule type
- A threshold rule counts matching documents grouped by chosen fields and fires only when the count crosses the configured threshold within the rule interval.
- EQL sequence rule
- An EQL rule uses `sequence by <field> with maxspan=` to detect ordered events, such as a process start followed by an outbound network connection.
- Rule exception list entry
- Exception items hold entries made of a field, operator, and value; events matching those entries are excluded from generating alerts for the attached rule.
- Alert suppression
- Suppression groups alerts by chosen fields and produces one alert per group per interval instead of one alert per matching event.
- New terms rule type
- Fires when a field value appears that was not seen during the preceding lookback window, which is useful for first-seen anomalies like an unfamiliar parent process.
- Risk score field
- Each rule sets a risk score from 0 to 100, and its alerts contribute to entity risk scoring displayed in the entity Risk tab.
- KQL versus Lucene regex
- Kibana Query Language supports wildcards but not regular expressions; switch the search bar to Lucene syntax to use `/regex/` patterns.
- EQL join command
- The `join` command requires events to share the same join key and returns them regardless of order, unlike `sequence`, which enforces order and maxspan.
- Timeline investigation
- Timeline is a working area where analysts add query results, pin events, write notes, and run correlations; it can be saved and shared.
- ES|QL pipe syntax
- ES|QL chains commands with pipes, for example `FROM logs-* | WHERE ... | STATS count() BY host.name`, and executes server-side on the cluster.
- Discover field statistics
- Discover's field statistics view shows top values, distributions, and document counts for a field, useful for profiling hosts, users, or processes.
- Alert close reasons
- Closing an alert requires a reason such as duplicate, false positive, true positive, or benign; this changes status but keeps the alert record.
- Case connector
- Connectors push case data to third-party systems like ServiceNow, Jira, or Slack, and the same connector types also power rule notification actions.
- Rule action frequency
- A rule action can run for every generated alert, as a summary of alerts in the interval, or on a custom action interval you define.
- Attach alerts to case
- Alerts and events can be attached to a case, preserving their context so analysts can triage and track remediation together in one place.
- Endpoint action in rule
- Detection rules can trigger endpoint actions such as isolate host or kill process on matching alerts, subject to license and user privileges.
- Elastic Defend protection modes
- Each Elastic Defend policy sets malware, ransomware, memory, and behavior protections to prevent, detect, or off, configured separately per operating system.
- Host isolation
- Isolating a host blocks its network traffic except the Elastic Agent connection to Fleet, so analysts keep telemetry while containing the machine.
- Trusted applications
- Trusted application entries exclude known-good binaries from malware and behavior checks, reducing false positives while the rest of monitoring stays active.
- Event filters
- Event filters stop specified events from being captured or uploaded by Elastic Defend, removing noise at the source before any indexing occurs.
- Defend process event fields
- Process events carry `process.name`, `process.pid`, `process.parent.name`, and `process.entity_id`, which you chain to reconstruct process ancestry.