Describe How the Detection Engine Searches Activity and Generates Alerts ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst notices that a specific detection rule has not generated any alerts in the past week, despite a known increase in suspicious activity. The rule is a query rule that searches the logs-* index pattern. The analyst checks the rule's configuration and sees that the rule is enabled and the schedule is set to run every 5 minutes. What is the most likely reason the rule is not generating alerts?

   • AThe rule's severity is set too low, so alerts are automatically closed without notification.
   • BThe rule's query is too broad, and the Detection Engine suppresses alerts to avoid noise.
   • CThe rule's index pattern does not include the indices where the suspicious activity is being logged.
   • DThe rule's schedule is too frequent, causing the Detection Engine to skip executions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team wants to ensure that detection rules are executed continuously and promptly to minimize the time between an event occurring and an alert being generated. They have a mix of query, threshold, and correlation rules. What is the primary mechanism the Detection Engine uses to achieve this?

   • AManual execution of rules by analysts
   • BMachine learning models that predict future events
   • CScheduled queries that run at defined intervals
   • DReal-time streaming of all events to the rule engine
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What happens when a detection rule's search criteria are met?

   • AThe Detection Engine generates an alert and may also create a case
   • BThe rule is automatically disabled to prevent further alerts
   • CThe Detection Engine sends an email to all users in the 'admin' role
   • DThe matched events are permanently deleted from the indices
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which rule type is designed to generate an alert when the number of matching events reaches a specified threshold?

   • AQuery rule
   • BMachine learning rule
   • CCorrelation rule
   • DThreshold rule
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A detection engineer is tuning a threshold rule that detects multiple failed login attempts from the same source IP. The rule currently groups by source IP and triggers when the count exceeds 10 within 5 minutes. The team is seeing too many alerts from a few legitimate users who frequently mistype passwords. They want to reduce false positives while still detecting brute-force attacks. What should the engineer do?

   • ADecrease the threshold to 5 and shorten the time window to 2 minutes.
   • BIncrease the threshold to 20 and extend the time window to 10 minutes.
   • CChange the rule to a query rule that alerts on each failed login.
   • DRemove the grouping by source IP.
   Reveal Solution Discussion Select an answer first