Elastic Certified SIEM Analyst key terms

A set of one or more Elasticsearch nodes that together store and search data, distributing indices across shards and replicas. Security events, alerts, and configuration all live in this cluster.

A namespace inside Kibana that isolates saved objects such as dashboards, detection rules, cases, and alerts from other spaces. Security teams often use a dedicated space with its own alert indices.

The Elasticsearch and Kibana model that grants privileges through roles assigned to users or mapped from an identity provider. Analysts need index read access plus Kibana feature privileges for rules and cases.

Hidden Elasticsearch indices named .alerts-security.alerts- where the detection engine writes the alerts it generates. Analysts read them through the Alerts page or direct queries.

A feature that lets a local cluster search indices on remote clusters using a cluster-name:index pattern. It is useful when security data is spread across regional or tenant deployments.

The Kibana application that centrally manages Elastic Agents, their policies, and integrations, with a Fleet Server coordinating enrollment and policy delivery. It removes the need to configure each host by hand.

A single shipper installed on hosts that runs integrations to collect logs, metrics, and security events and sends them to Elasticsearch. It is enrolled with and managed through Fleet.

A Fleet object defining which integrations, outputs, and settings a group of Elastic Agents receives. Agents enrolled under the same policy pick up changes made in Kibana automatically.

A packaged bundle of assets - data streams, ingest pipelines, dashboards, and often detection rules - that onboards a particular data source such as Windows, AWS, or endpoint telemetry.

A documented set of field names and data types used to normalize events from different sources into a shared structure. Consistent ECS fields let rules and searches work across many integrations.

An append-only, time-series abstraction backed by hidden indices and governed by an index template and lifecycle policy. Most integrations write security events into data streams rather than standalone indices.

A chain of processors that parse, enrich, and transform documents before indexing, for example Grok parsing, date extraction, or GeoIP enrichment. Integrations ship default pipelines that normalize data into ECS.

Policies that move indices or data streams through hot, warm, cold, and delete phases by age or size. They govern retention and storage cost for high-volume security data.

A saved configuration that runs a query or logic against Elasticsearch data on a schedule and creates alerts when conditions match. Rules may be prebuilt or custom and support exceptions, suppression, and actions.

A rule type that evaluates a KQL, Lucene, or EQL query against chosen indices on a defined schedule. It is the usual way analysts express bespoke detections for their own environment.

A rule type that alerts only when the count of matching events, grouped by selected fields, crosses a threshold within a window. It reduces noise from isolated low-signal events.

A rule type that compares incoming events with threat intelligence indicators stored in an Elasticsearch index, alerting when values such as file hashes or IP addresses align.

An anomaly detection job that learns normal patterns in a data set and flags statistically unusual events. Machine learning detection rules alert when such anomalies occur within their time buckets.

A condition attached to a rule that keeps matching events from producing alerts, for example a known-good signer or service account. Exceptions cut false positives without disabling the rule.

A rule setting that collapses repeated matches on chosen fields into one alert per interval, limiting duplicates coming from the same host, user, or process.

Rule metadata that links a detection to adversary tactics and techniques in the MITRE ATT&CK framework. It supports coverage analysis and reporting inside Elastic Security.

A reusable, centrally managed set of values such as allowed IP ranges or known-bad domains that rules and exceptions can reference instead of hard-coded terms.

The Kibana app for searching, filtering, and inspecting raw documents in a data view. Analysts use it to confirm ingestion and to pivot on fields before building detections.

An investigation workspace in Elastic Security where analysts gather alerts and events, add notes, and assemble a chronological view of an intrusion. Timelines can be saved and shared.

A simplified query syntax for filtering documents by field values, supporting free text, wildcards, ranges, and boolean operators. It is the default search bar language in Kibana.

The Elasticsearch query string syntax offering constructs such as nested field paths, regular expressions, and grouping. Kibana search bars can switch to it when KQL is not expressive enough.

A query language built for event sequences and correlations, such as a process spawning a child that then opens a network connection. EQL powers sequence-based custom rules and Timeline queries.

A piped query language in Kibana that transforms and aggregates data with commands such as FROM, WHERE, STATS, and EVAL. It adds aggregation power beyond KQL's filtering-only approach.

A Kibana object pointing at one or more indices or data streams plus a time field, enabling searches and visualizations across that data. It was formerly called an index pattern.

The review of generated alerts to judge whether each is a true positive and to decide on escalation or closure. It relies on alert details, related events, and consistent status updates.

The lifecycle state of an alert - open, acknowledged, or closed - used to track triage progress and handoffs between analysts. Status changes can also drive automated workflows.

A container in Elastic Security that collects alerts, events, comments, tasks, and assignees for one investigation. Cases give responders a shared, auditable record of an incident.

A configuration that sends case details or alert notifications to external systems such as Jira, ServiceNow, Slack, or email, keeping ticketing and chat channels aligned with the investigation.

An action run manually from an alert or automatically by a rule, such as isolating a host or running an Osquery query, usually delivered to endpoints through a response action connector.

A score for a host or user computed from the alerts linked to that entity, helping analysts decide which assets deserve attention first during triage.

The endpoint integration that provides prevention, detection, and rich event collection on hosts, streaming process, file, network, and registry activity to Elasticsearch.

An endpoint protection capability that blocks or reports malicious files and processes using signatures and machine learning models on the host, surfacing malware events in Elastic Security.

Endpoint rules that detect or block suspicious process behavior, such as credential dumping or ransomware-style file encryption, complementing signature-based malware prevention.

A response action that severs a compromised host from the network while keeping its connection to Elastic, containing an active intrusion while analysts investigate.

An agent capability that runs SQL-style queries against operating system state - processes, users, open sockets - giving analysts live host visibility from Kibana without remote shell access.