Analyze Alerts That Are Generated from Detection Rules ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst receives an alert from a detection rule that flags a single failed login followed by a successful login from the same user within 5 minutes. The alert's `event.action` field shows `authentication_failure` and `authentication_success`, and the `source.ip` is the same. The analyst needs to determine if this alert is a true positive. Which action best validates the alert?

   • ACheck the `event.outcome` field on both events to confirm the failure and success are real, then review the `user.name` and `source.ip` for known brute-force patterns.
   • BEscalate the alert to the incident response team immediately without any further investigation.
   • CIgnore the alert because a successful login after a failure is normal user behavior and not suspicious.
   • DImmediately block the source IP in the firewall to prevent further access, assuming the alert is a true positive.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of contextual data that can enrich an alert?

   • AThe user's department and manager
   • BThe rule's last update time
   • CThe alert's unique identifier
   • DThe rule's MITRE ATT&CK technique
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After investigating a false positive alert, an analyst needs to document the findings. What is the most important information to include in the documentation?

   • AThe steps taken to block the source IP, even though the alert was a false positive.
   • BThe user's name and their manager's contact information.
   • CThe analyst's personal opinion about the alert's severity.
   • DThe alert ID, the reason it was a false positive, and the evidence that supported that conclusion.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   After determining an alert is a false positive, what is an appropriate follow-up action?

   • AImmediately contain the affected host
   • BDelete the underlying events
   • CEscalate the alert to the incident response team
   • DTune the detection rule to reduce future false positives
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which field in an Elastic Security alert document indicates the severity level assigned by the detection rule?

   • Aevent.severity
   • Bsignal.severity
   • Ckibana.alert.risk_score
   • Dsignal.rule.severity
   Reveal Solution Discussion Select an answer first