How can an analyst add an event to a Timeline from the Elastic Security UI?

By dragging and dropping the event from a table into the Timeline

By copying the event's JSON and pasting it into the Timeline

By sending the event to the Timeline via an API call

By right-clicking the event and selecting 'Add to Timeline'

An incident responder is using a Timeline to investigate a series of alerts that appear to be related to a single attacker. The alerts span multiple hosts and include different event types (e.g., process creation, network connections, file writes). The responder needs to understand the sequence of events across all hosts to determine the attacker's actions. Which approach best supports this systematic investigation workflow?

Use the Timeline's 'Notes' feature to manually write down the sequence of events.

Filter the Timeline to show only one event type at a time and take screenshots for the report.

Create a separate Timeline for each host and event type, then manually compare the timestamps.

Add all relevant events to a single Timeline and use the 'Correlation' view to group them by host and event type.

Which action is part of managing saved Timelines in Elastic Security?

Converting a Timeline into a detection rule

Sharing a Timeline with external users via email

Deleting a Timeline that is no longer needed

Which scenario best illustrates the use of Timeline to correlate relevant data?

An analyst adds a suspicious login event to a Timeline, then pivots to related user activity and network connections to identify the full scope of the intrusion.

An analyst views a dashboard showing the total number of alerts generated in the last 24 hours.

An analyst exports all security events to a CSV file for external analysis.

An analyst configures an alert rule to trigger when a specific malware signature is detected.

ElasticCertified SIEM Analyst

Domain 6Objective 5

Correlate Relevant Data Using Timeline ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Part of the Security Application domain, which makes up ~53% of our current practice bank.

20questions here

4free pages

5concepts

Questions 1–5

1foundation · easy
How can an analyst add an event to a Timeline from the Elastic Security UI?
Select an answer first
2foundation · easy
Which Timeline feature allows you to group events by a common field, such as host name or user name?
Select an answer first
3expert · hard
An incident responder is using a Timeline to investigate a series of alerts that appear to be related to a single attacker. The alerts span multiple hosts and include different event types (e.g., process creation, network connections, file writes). The responder needs to understand the sequence of events across all hosts to determine the attacker's actions. Which approach best supports this systematic investigation workflow?
Select an answer first
4foundation · easy
Which action is part of managing saved Timelines in Elastic Security?
Select an answer first
5foundation · easy
Which scenario best illustrates the use of Timeline to correlate relevant data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.

Correlate Relevant Data Using Timeline ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

How can an analyst add an event to a Timeline from the Elastic Security UI?

Which Timeline feature allows you to group events by a common field, such as host name or user name?

Which action is part of managing saved Timelines in Elastic Security?

Which scenario best illustrates the use of Timeline to correlate relevant data?

Keep studying — Security Application