8.1 Security App Capabilities & the Explore Pages (Hosts, Network, Users)

Elastic Certified SIEM Analyst Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Exam Overview & Study Strategy

1.1 Elastic Certified SIEM Analyst Exam Facts, Objectives & Study Plan

2 Chapter 2: Elastic Stack Architecture & SIEM Foundations

2.1 Elastic Stack Architecture for Security Operations 2.2 Telemetry Ingestion Architecture & Data Pipelines 2.3 Security Data Storage, Data Streams & ILM

3 Chapter 3: Elastic Common Schema (ECS) & Ingestion Normalization

3.1 ECS Structure, Core Principles & Essential Field Sets 3.2 Ingest Pipelines, Processors & Normalization Workflows 3.3 Fleet Server & Elastic Agent Integration Management

4 Chapter 4: Discover, Data Views & Security Query Languages

4.1 Kibana Discover, Security Data Views & Runtime Fields 4.2 Kibana Query Language (KQL) & Lucene for SecOps 4.3 ES|QL for Multi-Stage Security Analysis

5 Chapter 5: Security Visualizations & Threat Analytics

5.1 Metric, Aggregation & Histogram Visualizations for SOC 5.2 Data Tables, Heatmaps & Specialized Security Charts 5.3 Elastic Maps & Geospatial Telemetry Analysis

6 Chapter 6: Kibana Lens for Security Workflows

6.1 Lens Architecture & Multi-Layer Telemetry Visualizations 6.2 Lens Formulas, Ratios & Anomaly Baseline Metrics 6.3 Operationalizing Lens in SOC Triage & Drilldowns

7 Chapter 7: Security Dashboards & SOC Operations

7.1 Security Dashboard Architecture & SOC Layout Design 7.2 Interactive Controls, Time Sync & Cross-Filtering 7.3 Dashboard Exporting, Reporting & Spaces Sharing

8 Chapter 8: The Elastic Security App: Capabilities, Explore & Dashboards

8.1 Security App Capabilities & the Explore Pages (Hosts, Network, Users) 8.2 Monitoring with the Security App Dashboards

9 Chapter 9: Elastic Security Detection Engine & Core Rules

9.1 Detection Engine Architecture & Prebuilt Rule Management 9.2 Custom Query & Threshold Detection Rules 9.3 Event Correlation Rules with Event Query Language (EQL)

10 Chapter 10: Advanced Detection Rules, ML & Rule Tuning

10.1 Threat Intelligence & Indicator Match Rules 10.2 New Terms, ES|QL & Machine Learning Detection Rules 10.3 Detection Rule Tuning, Exceptions & Alert Suppression

11 Chapter 11: Alert Triage, Timelines & Investigation Workflows

11.1 Alert Triage Workflow & the Alert Details Flyout 11.2 Elastic Security Timeline & Timeline Templates 11.3 Visual Event Analyzer & Session View Forensics

12 Chapter 12: Case Management, Integrations & AI Assistant

12.1 Elastic Security Case Management & Triage Workflows 12.2 Case Connectors & External Incident Escalation 12.3 Elastic AI Assistant for Security & Attack Discovery

13 Chapter 13: Security Administration, RBAC & Kibana Spaces

13.1 Kibana Spaces for SOC Multitenancy & Segmentation 13.2 Role-Based Access Control, Feature Privileges & Index Security 13.3 Elastic Defend Administration & Endpoint Policy Controls

14 Chapter 14: End-to-End Threat Hunting & Incident Investigation Capstone

14.1 Hypothesis-Driven Threat Hunting & Baselining in Elastic 14.2 Investigating Lateral Movement & Credential Access Campaigns 14.3 Data Exfiltration, C2 Detection & Incident Reconstruction

8.1 Security App Capabilities & the Explore Pages (Hosts, Network, Users)

Key Takeaways Explain This Topic AI

The Security app groups its capabilities into detection rules, the Alerts page, investigation tools (Timeline, visual event analyzer, Session View, Osquery), Explore, dashboards, Cases and AI features.

The Hosts page has Events, All hosts, Uncommon processes, Anomalies, Host risk and Sessions tabs, and its Sessions tab opens Linux sessions in Session View.

The Network page combines an interactive map (which needs Maps privileges) with Events, Flows, DNS, HTTP, TLS and Anomalies tabs.

IP details pages show location, first and last seen, the related host, alert metrics and reputation links that default to Talos and VirusTotal.

The Users page has Events, All users, Authentications, Anomalies and User risk tabs, and host and user risk tabs require Platinum with the risk engine turned on.

Last updated: September 2026

The Security app is where most of the SIEM Analyst objectives live. Elastic's objectives ask you to recognize the capabilities of the Security App and use Explore within the Security App to view security-related events . This section gives you a map of the app and then walks through the three Explore pages: Hosts , Network and Users .

What the Security App Does

The Security app is a Kibana application that works on data matched by the securitySolution:defaultIndex setting (Beats and Elastic Agent indices such as logs-* by default) and on the detection alerts in .alerts-security.alerts-<space-id> . Its capabilities group naturally by job:

Job Security App Capability Where You Find It

Detect Prebuilt and custom detection rules (query, EQL, threshold, indicator match, new terms, ES|QL, machine learning), exceptions, value lists Rules

Triage Alerts page with filters, grouping, charts, tags and assignees; alert details flyout Alerts

Investigate Timeline (KQL, EQL correlation, ES|QL), visual event analyzer, Session View, Osquery Timelines and the Timeline bar at the bottom of most pages

Explore Hosts, Network and Users pages with KPIs, tables and details pages Explore

Monitor Default dashboards: Overview, Detection & Response, Entity Analytics, Data Quality, Kubernetes, cloud security dashboards, Detection rule monitoring Dashboards

Respond and track Cases with external connectors; endpoint response actions and host isolation Cases; alert and endpoint actions

Intelligence Ingested threat indicators and threat intelligence enrichment of alerts Intelligence; alert flyout Insights

AI Elastic AI Assistant and Attack Discovery (Enterprise) Chat buttons; Attack discovery page

Protect endpoints and cloud Elastic Defend endpoints, policies and artifacts; cloud posture and vulnerability findings Manage / Assets; Findings

Two conventions tie these areas together:

Timeline everywhere. The Timeline bar is available across the app, and most tables and charts offer Add to timeline or drag-and-drop into Timeline. Values flow from Explore, Alerts and dashboards straight into an investigation.

Consistent inline actions. Hovering over a value typically offers Filter In , Filter Out , Add to timeline , Show top N and Copy to clipboard . Charts offer an options menu with Inspect , Add to new or existing case and Open in Lens .

Explore: The Hosts Page

The Hosts page summarizes every host that appears in your security data and its events.

KPI charts show the number of hosts and unique IPs for the selected time range. Their actions menu lets you inspect the query, open the chart in Lens, or add it to a case.

Tabs below the charts:

Events : all host events. Show only external alerts filters to alerts received from external monitoring tools.

All hosts : high-level host details.

Uncommon processes : processes that run on few hosts, a quick way to spot unusual binaries.

Anomalies : anomalies found by machine learning jobs.

Host risk : the latest host risk score and level for each host. It needs a Platinum subscription or higher, and the risk engine must be turned on.

Sessions : Linux process sessions that open in Session View .

Host details page (click a host name in All hosts ): asset criticality, a summary with host ID, first and last seen, IP addresses, operating system and risk data, alert metrics by severity, rule and status, and the same tabs filtered to that host.

Host details flyout : opened by clicking a host name in the Alerts table, the Entity Analytics dashboard and other tables. It shows the host risk summary (with View risk contributions listing the top 10 contributing alerts), asset criticality, and observed data.

Explore: The Network Page

The Network page focuses on network activity.

Interactive map : shows source and destination points. You need Read or All privileges for Maps , and the map data must be configured (network map data). From the map you can add a filter, drag a field to Timeline, click a host name to open the Hosts page, or click an IP to open its IP details page .

Widgets : network events, DNS queries, unique flow IDs, TLS handshakes and unique private IPs.

Tabs : Events , Flows (source and destination IPs and countries), DNS , HTTP , TLS (handshake details) and Anomalies .

IP details page : location, first and last seen, the associated host ID and host name, and external reputation links , which default to Talos and VirusTotal and can be changed in advanced settings. It also shows alert metrics and the same tables filtered to that IP.

Explore: The Users Page

The Users page covers identities and authentication.

KPI charts : total users and successful and failed authentications.

Tabs :

Events : events that contain user.name , which you can stack by event.action , event.dataset or event.module .

All users : user names, when they were last active, and their domains.

Authentications : authentication events with success and failure counts and the last successful destination host.

Anomalies : machine learning anomalies involving user data.

User risk : the latest user risk score and level (Platinum or higher, risk engine turned on).

User details page and flyout : asset criticality, a summary, alert metrics, and the user risk summary with contributing alerts.

Using Explore in an Investigation

A typical flow shows how the pages connect:

An alert fires for suspicious PowerShell on wks-fin-04 . From the Alerts table, click the host name to open the host details flyout . The host risk is High , and several other alerts contributed to it.

Open the host's details page . On Uncommon processes , rclone.exe appears on this host and almost nowhere else.

Switch to the Network page, filter to the host, and check the Flows and DNS tabs. Large outbound flows go to an unfamiliar IP.

Click the IP to open its IP details page , and use the VirusTotal and Talos links to check its reputation.

Drag the host name and the IP into Timeline to build a combined query, pin the key events, and attach the Timeline to a case.

Page Best For Key Tabs

Hosts What ran where; rare processes; Linux sessions; host risk Events, All hosts, Uncommon processes, Anomalies, Host risk, Sessions

Network Who talked to whom; DNS, HTTP and TLS details; IP reputation Events, Flows, DNS, HTTP, TLS, Anomalies

Users Authentication behavior; account activity; user risk Events, All users, Authentications, Anomalies, User risk