Elastic Certified SIEM Analyst study plan
Elastic Certified SIEM Analyst · Give each week a clear focus.
8 weeks · About 6 hours per week
Elastic Security architecture, deployment, and cluster/space configuration
Map the full ingest-and-detection path from Elastic Agent through Fleet, Elasticsearch ingest pipelines, and the detection engine on one page
Stand up a single-node lab cluster with Kibana and Fleet Server, then record every configuration choice you make
Create two Kibana spaces and configure role-based access so a user in one space cannot see the other space's detection rules
Identify which cluster settings (index lifecycle, rule execution, alerting) affect detection reliability and write down why each one matters
Your checkpoint
A one-page architecture diagram plus a configuration log listing cluster, Fleet, and space/role settings with a one-line justification for each
Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema)
Enroll an Elastic Agent and attach at least two integrations, then confirm in Discover that events carry the expected ECS fields
Trace an incoming log through its ingest pipeline and document each ECS field-mapping decision
Ingest a custom log source using a custom pipeline and correct field names that do not match ECS
Compare agent-based collection with an alternative ingestion path and state when each is appropriate
Your checkpoint
A field-mapping worksheet for two integrations plus one custom source, showing source field, target ECS field, and evidence in Discover that events land correctly
Detection engineering: prebuilt and custom detection rules, alerts, exceptions
Enable the prebuilt detection rules relevant to your lab data and explain how rule versioning and updates behave
Write exceptions for a noisy rule and demonstrate the alert volume dropping without losing true positives
Distinguish query, threshold, indicator-match, and machine-learning rule types and pick the right one for three given scenarios
Configure an alert to route to a destination you can inspect and verify it fires end to end
Your checkpoint
A tuning report for one rule showing before/after alert counts, the exception logic used, and a written justification for why true positives were preserved
Detection engineering: prebuilt and custom detection rules, alerts, exceptions & Investigation and threat hunting in Kibana (Discover, Timeline, query languages)
Author two custom rules from scratch - one using EQL for a sequence and one using a threshold - and validate each against generated test events
Investigate a rule's alerts in Timeline and pivot from an alert to related process and network events
Write the same hunt query in KQL and in ES|QL and note where each language is stronger for an investigation
Your checkpoint
A detection package containing two custom rules (exported JSON), the test events used to validate them, and a short write-up of the investigation each alert led to
Investigation and threat hunting in Kibana (Discover, Timeline, query languages)
Build a hunting workflow in Discover that moves from a hypothesis to a saved search with documented field breakdowns
Reconstruct an intrusion sequence across hosts using Timeline, attaching events to a case as you go
Practice three query techniques: fast keyword filtering, aggregation-based baselining, and sequence detection
Hunt one ATT&CK technique of your choice and record both what you found and what you could not conclude
Your checkpoint
A hunting notebook: one hypothesis, the queries run in each language, screenshots-free written evidence of results, and a conclusion stating confidence and gaps
Endpoint security, prevention, and host/network visibility
Configure endpoint protection settings in a policy and describe which prevention actions are available and their trade-offs
Generate benign host activity and confirm the resulting process, file, and network events populate ECS fields correctly
Explain how host isolation and response actions are triggered and what evidence they leave behind
Map the endpoint and network telemetry you collected to at least five ATT&CK techniques
Your checkpoint
A telemetry coverage matrix listing each observed event category, the ECS fields available, and the ATT&CK techniques it supports
Case management, alert triage, and automated response workflows
Triage a batch of alerts into closed, escalated, and case-linked outcomes using a consistent written rubric
Build a case, attach alerts and Timeline events, and assign tasks so the investigation state is fully reconstructable
Configure one automated response workflow and verify it triggers on the correct rule condition
Document an escalation path that a second analyst could follow without asking you questions
Your checkpoint
A triage runbook plus one completed case record demonstrating alert-to-case-to-automation flow with timestamps
Elastic Security architecture, deployment, and cluster/space configuration & Data onboarding and ingestion (Elastic Agent, integrations, Elastic Common Schema) & Detection engineering: prebuilt and custom detection rules, alerts, exceptions & Investigation and threat hunting in Kibana (Discover, Timeline, query languages) & Case management, alert triage, and automated response workflows & Endpoint security, prevention, and host/network visibility
Re-run practice questions from your weakest domain and re-teach each missed concept from documentation
Consolidate all prior deliverables into one indexed review document organised by exam domain
Complete two timed full-length practice sets and analyse every incorrect answer by root cause
Rehearse explaining the end-to-end lifecycle - ingest, detect, investigate, respond - in five minutes without notes
Your checkpoint
A consolidated review document with a ranked weak-area list and a remediation note per weak area
Milestones
Week 1: You can sketch the agent-to-detection data path from memory and correctly state the effect of a space/role misconfiguration on rule visibility
Week 2: Every ingested source in your lab shows the expected ECS fields in Discover, verified field by field against your mapping worksheet
Week 4: Both custom rules fire only on intended test events, and you can explain each rule's type choice and exception logic without notes
Week 6: Your coverage matrix names at least five ATT&CK techniques backed by telemetry you actually observed, not assumed
Week 7: A second person could reconstruct your case from the record alone - alerts, timeline, tasks, and automation are all traceable
Week 8: Two timed practice sets completed with a documented root cause for every miss and no weak area left without a remediation note