Elastic Certified SIEM Analyst study guide
Elastic Certified SIEM Analyst · Work through your exam, one topic at a time.
The Elastic Certified SIEM Analyst credential is aimed at security operations practitioners who work day to day inside Elastic Security - SOC analysts, detection engineers, and threat hunters who need to prove they can run the platform rather than just describe it. The exam blueprint spans the full analyst workflow: cluster architecture and space configuration; onboarding data through Elastic Agent and integrations while normalizing to the Elastic Common Schema; building and tuning detection rules, alerts, and exceptions; investigating and hunting in Kibana with Discover, Timeline, and the query languages; case management, alert triage, and automated response; and endpoint prevention with host and network visibility. The Elastic Certified SIEM Analyst study guide has 6 sections and about 2,260 words.
01Elastic Security Architecture, Deployment, and Space Configuration
Elastic Security is a Kibana application on top of an Elasticsearch cluster. Elasticsearch stores event data, detection rule configuration, generated alerts, and cases; Kibana hosts the Security app UI and, critically, runs the detection engine using the Kibana Alerting framework.
368 words, about 2 min02Data Onboarding and Ingestion: Elastic Agent, Integrations, and ECS
Modern onboarding flows through Fleet: you install a Fleet Server, enroll Elastic Agents with an enrollment token, create an agent policy , and attach integrations to that policy. Each integration supplies the ingest pipeline, index template, and data stream definition for a source; a saved policy change is rolled out to agents on their next check-in.
362 words, about 2 min03Detection Engineering: Prebuilt and Custom Rules, Alerts, and Exceptions
The detection engine supports several rule types, and picking the wrong one is the most common exam trap. Custom query rules match single events (KQL or Lucene).
392 words, about 2 min04Investigation and Threat Hunting: Discover, Timeline, and Query Languages
KQL is the Kibana default: field: value , quoted phrases, wildcards, ranges with = , and explicit and/or/not . It is forgiving but does not allow a leading wildcard efficiently and needs an explicit to test field existence.
388 words, about 2 min05Case Management, Alert Triage, and Automated Response Workflows
Alerts arrive in the Alerts table with rule name, severity, risk score, and status. Status moves through open → acknowledged → closed , and closing requires a reason (for example duplicate, false positive, true positive, benign).
370 words, about 2 min06Endpoint Security, Prevention, and Host/Network Visibility
Elastic Defend is the endpoint integration managed through Fleet. Its policy exposes protection settings - malware, ransomware, memory threat, and behavior protection - each typically switchable between detect and prevent, plus event capture toggles for process, file, network, DNS, registry, security, and authentication events.
380 words, about 2 min