Exabeam Analyst study plan

Map the log pipeline end to end (collection, parsing, normalization, enrichment, indexing, retention) and draw it from memory

Classify at least 12 common source types (endpoint EDR, proxy, VPN, IdP/SSO, cloud audit, DNS, email gateway, Windows security) by which fields each contributes to identity and asset context

Explain how time skew, timezone handling, and event ordering affect correlation and investigation timelines

Identify which fields are required to resolve a raw event to a specific user and a specific asset

Write and validate 5 search/query patterns: single-user timeline, single-host timeline, rare-process lookup, authentication-failure aggregation, and outbound-destination volume ranking

Diagnose 3 common data-quality failures (unparsed events, missing user mapping, duplicate ingestion) and state the fix for each

Describe how watchlists, context tables, and asset/user inventories change what a query returns

Practice scoping a search by time window and entity to keep result sets investigative rather than exhaustive

Define baseline, peer group, and anomaly score in behavioral-analytics terms and explain how each is computed conceptually

Enumerate at least 10 behavioral features worth baselining (logon hour, source geography, host set, process set, data volume, authentication method, device, service account usage, first-seen pairs, session duration)

Explain concept drift, seasonality, and cold-start problems, and how each produces false positives or false negatives

Compare rule-based detection with statistical/anomaly detection and state when each is appropriate

Interpret a risk-scoring model: how per-event risk accumulates into an entity risk score and what thresholds trigger escalation

Build 3 behavioral detection hypotheses (impossible travel, anomalous first-seen peer-to-peer access, off-hours privileged use) and specify the data each needs

Trace a low-and-slow anomaly from first weak signal to a justified escalation decision

Explain how tuning (suppression, threshold adjustment, peer-group reassignment) trades detection sensitivity against alert volume

Walk the full TDIR lifecycle (triage, scoping, containment, eradication, recovery, lessons learned) and state the analyst decision at each stage

Triage 5 alert types by severity, blast radius, and confidence, writing the reasoning for each

Practice scoping an incident: determine affected identities, hosts, and data, and identify the pivot points that expand scope

Draft containment options for a compromised identity versus a compromised endpoint and state the tradeoffs of each

Distinguish insider threat categories (data exfiltration, privilege misuse, sabotage, negligent insider) and the behavioral signals characteristic of each

Identify at least 8 high-value indicators: mass file access, unusual archive/USB activity, off-hours access to sensitive repositories, resignation-adjacent behavior, access outside role, peer-comparison outliers

Explain how peer-group and role-based baselining reduce false positives for privileged and departing users

Describe privacy, consent, and proportionality considerations when monitoring employee behavior and how they constrain analyst action

Build an investigation narrative for an insider data-exfiltration scenario using only behavioral and log evidence

Separate weak signals from corroborated evidence and state what additional data would confirm or refute the hypothesis

Write escalation and handoff notes suitable for HR, legal, or management involvement without overstating findings

Identify where insider cases differ from external-intrusion cases in evidence standards and response authority

Run a timed 60-question mixed self-assessment across all four domains and score each domain separately

Re-study the two weakest domains using your own week 1-7 deliverables rather than new material

Re-derive from memory the log pipeline, the risk-scoring flow, and the TDIR lifecycle

Write a one-page decision checklist for triage and escalation you would actually use on shift