Study guide
Elastic Certified SIEM Analyst study guide
Read a lesson, then practice the ideas you want to remember.
Lessons
- Detection Rule Tuning, Exceptions & Alert Su
- New Terms, ES|QL & Machine Learning Detectio
- Threat Intelligence & Indicator Match Rules
- Alert Triage Workflow & the Alert Details Fl
- Visual Event Analyzer & Session View Forensi
- Elastic Security Timeline & Timeline Templat
- Elastic AI Assistant for Security & Attack D
- Elastic Security Case Management & Triage Wo
- Case Connectors & External Incident Escalati
- Custom Query & Threshold Detection Rules
- Detection Engine Architecture & Prebuilt Rul
- Event Correlation Rules with Event Query Lan
- ES|QL for Multi-Stage Security Analysis
- Kibana Discover, Security Data Views & Runti
- Kibana Query Language & Lucene for SecOps
- ECS Structure, Core Principles & Essential F
- Fleet Server & Elastic Agent Integration Man
- Ingest Pipelines, Processors & Normalization
- Elastic Certified SIEM Analyst Exam Facts, O
- Lens Formulas, Ratios & Anomaly Baseline Met
- Lens Architecture & Multi-Layer Telemetry Vi
- Operationalizing Lens in SOC Triage & Drilld
- Elastic Defend Administration & Endpoint Pol
- Kibana Spaces for SOC Multitenancy & Segment
- Role-Based Access Control, Feature Privilege
- Security App Capabilities & the Explore Page
- Monitoring with the Security App Dashboards
- Dashboard Exporting, Reporting & Spaces Shar
- Interactive Controls, Time Sync & Cross-Filt
- Security Dashboard Architecture & SOC Layout
- Data Tables, Heatmaps & Specialized Security
- Elastic Maps & Geospatial Telemetry Analysis
- Metric, Aggregation & Histogram Visualizatio
- Elastic Stack Architecture for Security Oper
- Security Data Storage, Data Streams & ILM
- Telemetry Ingestion Architecture & Data Pipe
- Data Exfiltration, C2 Detection & Incident R
- Hypothesis-Driven Threat Hunting & Baselinin
- Investigating Lateral Movement & Credential