During an investigation, an analyst wants to quickly understand the distribution of event types in the current result set. The analyst has already run a search that returns thousands of events. Which action would give the analyst a quick visual summary of the event.category field values?

Use the search bar to type 'event.category:*'.

Click the event.category field in the sidebar to open its field statistics.

Sort the table by event.category.

Add event.category as a column in the table.

An analyst has configured a Discover view with a specific query, filters, and a custom set of columns. The analyst wants to return to this exact view later without recreating it. What should the analyst do?

Take a screenshot of the Discover interface.

Bookmark the current URL in the browser.

Export the table to a CSV file.

Save the current search as a saved search.

A colleague has saved a search named `Failed Logins - Last 24h` in the shared Kibana space. How can an analyst open this saved search in Discover?

Navigate to Stack Management and import the search

Refresh the browser to auto-load all saved searches

Type the search name in the KQL search bar

Use the Open menu in Discover and select the saved search

An analyst wants to view the most recent events first in Discover. What is the correct way to sort results by the `@timestamp` field in descending order?

Click the @timestamp column header to toggle to descending order

Adjust the time picker to a recent range

Type `sort: @timestamp desc` in the search bar

Use the density setting to change display order

An analyst has a saved search that returns events for a specific user. The analyst now wants to modify the search to also include events from a second user. What is the correct way to update the saved search?

Load the saved search, modify the query to include the second user, and save it again.

Edit the saved search directly in the Saved Searches menu without loading it.

Create a new saved search from scratch with the new query.

Use the search bar to type the new query and then close the tab.

ElasticCertified SIEM Analyst

Domain 3Objective 1

Customize the Discover Interface to Search for Data ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 3)

Part of the Discover domain, which makes up ~5% of our current practice bank.

23questions here

5free pages

6concepts

Questions 11–15

11application · medium
During an investigation, an analyst wants to quickly understand the distribution of event types in the current result set. The analyst has already run a search that returns thousands of events. Which action would give the analyst a quick visual summary of the event.category field values?
Select an answer first
12application · medium
An analyst has configured a Discover view with a specific query, filters, and a custom set of columns. The analyst wants to return to this exact view later without recreating it. What should the analyst do?
Select an answer first
13foundation · easy
A colleague has saved a search named `Failed Logins - Last 24h` in the shared Kibana space. How can an analyst open this saved search in Discover?
Select an answer first
14foundation · easy
An analyst wants to view the most recent events first in Discover. What is the correct way to sort results by the `@timestamp` field in descending order?
Select an answer first
15application · medium
An analyst has a saved search that returns events for a specific user. The analyst now wants to modify the search to also include events from a second user. What is the correct way to update the saved search?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ELASTIC-CERTIFIED-SIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Elastic. “ELASTIC-CERTIFIED-SIEM-ANALYST” is a trademark of its owner, used for identification only.