Describe How the Detection Engine Searches Activity and Generates Alerts ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A detection engineer needs to create a rule that alerts when a user logs in from a new geographic location and then performs a privileged action within 5 minutes. The rule must correlate these two different event types. Which rule type should the engineer use?

   • AMachine learning rule
   • BThreshold rule
   • CQuery rule
   • DCorrelation rule
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A detection rule is configured to run every 10 minutes and search for a specific command-line pattern. The rule uses the default time range of the last 5 minutes. An analyst notices that some events that occurred 7 minutes before the rule ran were not included in the search results. What is the most likely reason?

   • AThe rule's schedule interval is too long, causing the engine to miss events.
   • BThe rule's index pattern does not include the indices where the events are stored.
   • CThe rule's query is too narrow and does not match the events.
   • DThe rule's time range is set to the last 5 minutes, so events older than 5 minutes are not searched.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which component is responsible for creating an alert when a rule matches?

   • AThe Detection Engine
   • BThe Kibana dashboard
   • CThe Elasticsearch ingest pipeline
   • DThe Logstash output plugin
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A detection rule generates an alert every time a specific user account is locked out. The SOC team is overwhelmed by the number of alerts and wants to reduce the noise. They decide to change the rule to a threshold rule that requires 5 lockouts within 15 minutes. What will be the impact on alert generation?

   • AAlerts will be generated only when the total number of lockouts across all users exceeds 5 in 15 minutes.
   • BAlerts will only be generated when 5 lockout events occur within 15 minutes.
   • CAlerts will be generated for every lockout event, but they will be automatically closed after 15 minutes.
   • DAlerts will still be generated for each lockout event, but with a lower severity.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a correlation rule?

   • ATo identify sequences or relationships between multiple events
   • BTo alert when the volume of events exceeds a set number
   • CTo detect a single event that matches a specific query
   • DTo suppress alerts for known false positives
   Reveal Solution Discussion Select an answer first