Correlate Relevant Data Using Timeline ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following can be added to a Timeline?

   • AOnly security alerts
   • BEvents, alerts, and other relevant data from various sources
   • COnly raw events from the Elasticsearch index
   • DOnly data from the host view
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is investigating a series of alerts that suggest a user account is being used from two different geographic locations within a short time frame. The analyst suspects a compromised account. They have a Timeline with the authentication events. What is the most effective way to use the Timeline to confirm this suspicion?

   • AUse the 'Notes' feature to manually record the IP addresses and locations.
   • BFilter the Timeline to show only events from one of the geographic locations.
   • CAdd the authentication events to the Timeline and use the 'Correlation' view to group by user name and source IP.
   • DCreate a new Timeline for each IP address and compare them side-by-side.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC team is establishing a standard procedure for investigating alerts. They want to ensure that all analysts follow a consistent workflow when using Timelines. What is a key component of a systematic Timeline investigation workflow?

   • AStart with a saved Timeline template that includes common filters and queries for the type of alert.
   • BAlways create a new Timeline from scratch for every investigation to avoid any bias.
   • CRely on the 'Filter out' option to remove all irrelevant events before starting the investigation.
   • DUse the 'Notes' feature to document the investigation steps, but do not save the Timeline.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC team is investigating a multi-stage phishing campaign. They have created a Timeline with a series of events from the initial email, the user clicking the link, and the subsequent beaconing traffic. The team wants to ensure this Timeline is available to other analysts in the SOC and can be referenced in their final incident report. What is the most appropriate way to manage this Timeline?

   • AExport the Timeline as a CSV file and attach it to the incident ticket.
   • BTake a screenshot of the Timeline and save it in the shared drive.
   • CSave the Timeline with a descriptive name and share it with the SOC team via the Elastic Security app.
   • DLeave the Timeline unsaved and rely on the browser history to restore it later.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is investigating a potential data exfiltration incident. They have a Timeline with several authentication events from a compromised user account. They now want to add the corresponding network traffic events from the firewall logs to the same Timeline to see if data was transferred. How can the analyst add these firewall events to the existing Timeline?

   • AExport the firewall events to a file and import them into the current Timeline.
   • BUse the 'Add to Timeline' action on the relevant firewall events from the Security or Discover pages.
   • COpen the firewall logs in a new tab and manually copy the event details into the Timeline notes.
   • DCreate a new Timeline for the firewall events and then merge the two Timelines manually.
   Reveal Solution Discussion Select an answer first